Does this result prove an access-control flaw?
An AI report says the document service may let a customer read someone else’s document.
The question
Larkspur Systems and all requests, documents and results are fictional. These are authorised lab checks. Only a document’s owner may read it; an anonymous caller or another customer must be denied. No exploit payload or live target is supplied.
| Observed result | |
|---|---|
| Anonymous caller | Denied |
| Document owner | Own document returned |
| Different customer | Other customer’s document returned |
Each row is a distinct access check, not a probability estimate.
No unauthorised document reads are permitted. A patch must preserve the owner’s supported access and cover every route serving the document.
“Choose your next action and explain the evidence behind it.”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: What is the security claim?
What would you do here? Open the move you’d make.
Name the violated access rule
The strong move. The result crosses a defined access boundary.
Call every successful response a vulnerability.
Tempting, but it misses something. The owner’s successful response is required behavior.
See how a strong candidate says it
“The different customer receives a document they do not own. That violates the stated owner-only rule.”
Why it works: The result crosses a defined access boundary.
Step 2: What does the evidence prove?
What would you do here? Open the move you’d make.
Scope the proven violation
The strong move. A concrete result supports a narrower claim than a whole-service compromise.
Claim all customer data has been stolen.
Tempting, but it misses something. A reachable lab flaw does not establish a real breach or its scope.
See how a strong candidate says it
“Two of three checks match the rule. The other-customer check proves a reachable violation on the view route in this lab.”
Why it works: A concrete result supports a narrower claim than a whole-service compromise.
Step 3: Does the view-route patch pass?
After the patch, the view route denies anonymous callers and other customers while returning the document to its owner. All three view checks now pass.
What would you do here? Open the move you’d make.
Check the other entry points
The strong move. Passing one route’s checks does not cover every entry point.
Close the finding after these three checks.
Tempting, but it misses something. The release rule covers all routes serving the document.
See how a strong candidate says it
“The three view checks now match the rule. I would also check the other routes that serve the same document.”
Why it works: Passing one route’s checks does not cover every entry point.
Step 4: What is still open?
The export route denies an anonymous caller and permits the owner, but also returns the document to another customer. These are three additional checks of the same owner-only rule.
What would you do here? Open the move you’d make.
Keep the shared-boundary finding open
The strong move. A single unauthorised read still fails the security gate.
Accept five of six because the pass rate is high.
Tempting, but it misses something. Security permission is not an average of passing checks.
See how a strong candidate says it
“Five of six checks pass, but export still returns the document to another customer. Keep the finding open and fix the shared authorisation rule.”
Why it works: A single unauthorised read still fails the security gate.
The answer, in short
- Decision
- Keep the finding open until all document entry points enforce ownership.
- Because
- The export route still permits an unauthorised read.
- What would change it
- Verified owner-only behavior on both routes, with supported owner access preserved.
Common traps
- A scanner description is not evidence of a breach.
- A route-only patch can leave the same flaw elsewhere.
Check your answer
- I stated the access rule.
- I separated a flaw from a breach claim.
- I tested every relevant entry point.
- I did not average away an unauthorised read.
Last reviewed Nov 10, 2026