An account that should see nothing got client data from eight endpoints
For CISOs and CTOs at platforms that hold client and portfolio data.
To test who can see what in a wealth-management API, we created an account with no access at all and called the endpoints with it. Several returned data anyway.
- Wealth management
- Client, portfolio and mandate API
- Compliance
- Clients
- Reputation
What was at risk
Personal data shown to an account with no rights
A people search and a portfolio search each returned dozens of rows to an account with no permissions. Context: unauthorised disclosure of personal data raises a GDPR breach question.
A protocol listing open to any login
The worst endpoint, a regulation-protocol listing, returned hundreds of records to the zero-access account (exact count withheld) and was rated critical.
A gap that one-role tests never see
The same token was refused elsewhere, so the leaks were scoping gaps in specific endpoints. A test that only checks the happy role will not find them.
Standards and rules in play
- Context: broken access controlOWASP lists broken access control first in its Top 10 web risks. We asserted the secure state: an account with no permissions gets an empty list or a refusal from every endpoint.
- Context: GDPR security of processingPersonal data returned to someone with no rights is an access-control failure of the kind GDPR security duties address.
How we tested it
- Test level
- System testing at API level, against the live environment.
- Test types
- Security testing (access control) and functional negative testing, run as a re-runnable suite.
- Test basis
- The rule: an account with no permissions must receive an empty list or a refusal from every endpoint.
- TechniqueError guessingWhere it showed upOne zero-permission account called the endpoints, and each test asserted the secure state, so a test is red exactly while the endpoint leaks.
- How we workedPositive controls for the probeWhere it showed upFive controls ran beside the nine tests: an empty positions tree, a permission error, a 403 on the standard API, and a garbage token and a missing token both turned away. All five stayed green.
Terms as in the ISTQB CTFL 4.0.1 syllabus and glossary.
What we found, and what it costs
- FindingCriticalA regulation-protocol listing returned hundreds of records to a zero-access accountWhat it costs youRecords meant for permitted users were readable by any login.
- FindingLeakA people search and a portfolio search returned dozens of rows each, the latter also through a collection aliasWhat it costs youNames and portfolios reached someone who should see nothing.
- FindingScopeEight endpoints in all, nine failing checksWhat it costs youNot one bug but a pattern of endpoints missing their scoping. Fixing them one by one turns each test green.
A call and a count were enough evidence to make the case to the client for each of them.
What changed
Each leak is now a test that is red while the endpoint leaks and turns green when it is fixed. The run exits as passed only if the five controls pass, so the suite stays useful while fixes land endpoint by endpoint.
Want your access control tested with an account that should see nothing?
We assert the secure state and prove the probe with controls. The first month is a trial.
