The public API spec listed the financing draft as the object that holds date of birth, birthplace, nationality, address, IBAN, income, employer, payroll files, and identity files.
The draft endpoints performed no ownership check. A guest login, with no email and no fee, was enough. Against another identity's draft:
| Operation | Result |
|---|---|
| Read | Full draft JSON |
| Update | The stored state changed |
| Attach a file | The file landed on the other draft |
| Delete a file | The file was removed |
| Submit | Reached business validation of the stored form, and stopped on missing test fields, not on authorization |
The draft id is a random UUID. The ad id is not a secret either. UUID is a locator.
What we proved
Read, update, file attach, and file delete across two identities we created. Submit reached the business rules of the other draft.
What this is not
We did not download a real customer's passport. The schema says what the object holds in production. The missing check is the finding. An empty test draft is enough to prove it.
Why a scanner misses it
Authenticated object authorization needs two sessions and a write followed by a read. "Must be logged in" is not "may only touch their own draft."
Buyer takeaway: Every id in a finance or KYC flow needs an ownership check on read and on write. If the spec says the object holds an identity scan, a missing check is High on an empty test draft.
