{
  "illustrative": true,
  "target": "demo.harbor.test",
  "title": "Cross-tenant invoice access",
  "cwe": "CWE-639",
  "severity": "Medium",
  "cvss": {
    "version": "3.1",
    "score": 6.5,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  "summary": "A member of Workspace A can read a synthetic invoice belonging to Workspace B.",
  "request": "GET /api/invoices/inv_8421 HTTP/1.1\nHost: demo.harbor.test\nAuthorization: Bearer [workspace-a-token]",
  "response": {
    "status": 200,
    "body": {
      "workspace_id": "workspace_b",
      "invoice_id": "inv_8421",
      "total": 2400
    }
  },
  "reproduction": [
    "Create two dedicated test workspaces.",
    "Create an invoice in Workspace B.",
    "Request its ID with the Workspace A session.",
    "Observe the response exposes Workspace B data."
  ],
  "remediation": "Scope invoice lookups to the caller\u2019s server-verified tenant and enforce object-level authorization.",
  "expected_retest": {
    "unauthorized": 404,
    "authorized_control": 200
  },
  "warning": "Synthetic example only. This is not evidence of a real scan."
}