Summary by seamsikdernahid
An IDOR vulnerability in Settle's GraphQL API allowed authenticated users to access sensitive financial information belonging to other tenants.
The issue affected the payerLocalBusinessId field in the updateReceivableInvoice mutation, which failed to enforce tenant ownership validation.
An attacker could retrieve other businesses' bank account numbers, routing numbers, beneficiary details, contact emails, and addresses.
The unauthorized reference also persisted, allowing the exposed information to be retrieved through the regular invoice listing query.