Hacking Enterprise Workspaces: Infiltrating Private Organizations with Just a Domain Name
One year ago, while testing an enterprise platform, I discovered an authorization vulnerability in their GraphQL API. The flaw allowed an attacker to enumerate private organizations, bypass access approvals, and join arbitrary enterprise workspaces using nothing more than a company’s email domain..
Read Analysis