The contractor login that could read everyone's orders—and an AI assistant that quoted them

This company is invented. The problem is one we see constantly on Application reviews.

A 40-person regional distributor ran a web portal where contractors signed in to check order history, download invoices, and ask an AI order assistant about stock and past quotes. The portal had been built by a capable agency, customers liked using it, and nothing appeared broken.

The written scope covered the public marketing site, the contractor portal, its API, and three test logins the company shared through our client portal: two separate contractor accounts and one warehouse staff account.

Our models signed in as Contractor A and compared every route and AI prompt against Contractor B:

1. Direct order access (OWASP API1:2023): Requesting /api/orders/88412 while signed in as Contractor A returned the full invoice and 18% custom discount tier belonging to Contractor B. The endpoint checked that someone was logged in, not that the order belonged to that account.
2. Cross-account AI quote leakage (OWASP LLM06:2025): Asking the portal's AI chat assistant to summarize recent stainless anchor quotes returned pricing pulled from PDFs uploaded under Contractor B's account, because the vector search had no account_id filter.
3. Observed outside of scope: The staff footer menu contained a direct link to erp.northline-internal.example. Because that host was not on the signed scope list, our outbound scope filter did not send a single request to it—we logged it under Observed, Not Tested so the IT contractor could put the ERP behind their VPN.

The agency fixed both authorization checks in three days. Our complimentary re-scan confirmed both were closed, and we issued a 1-page Letter of Attestation that the distributor sent to its largest enterprise customer the same week.