The lowest-privilege account reads the whole internal admin surface
Black-box external application penetration test, with a low-privilege member account provided mid-engagement. Anonymized.
Who we worked with.
A business-operations SaaS application serving several business clients from one deployment, with a built-in AI assistant.
Anonymized. No client names, people, domains, addresses or locations are published.
The question we were asked.
Every employee and every client user gets the same low-privilege role. The central question was simple: what can the least-privileged account actually reach, and does the tenant boundary hold under the hood?
Assessment modules used.
Black-box external application penetration test, with a low-privilege member account provided mid-engagement.
Application penetration test
The production application and its API, unauthenticated and authenticated surfaces.
Authorization & tenant boundaries
All authenticated testing as the lowest role the product issues.
Server-side request forgery lane
On a connection health-check.
AI assistant lane
Live prompt-injection and cross-tenant testing against the built-in assistant.
Canary-only destructive tests
Destructive tests run against canary data and reverted.
Severity, validated.
- CriticalMost internal administrative routes enforced no server-side role check. The lowest-privilege session could read the operator's internal admin surface and write to an internal workflow queue, with no exploit code. Broken function-level authorization, CVSS 9.1.
- HighFive High findings: a self-approvable quote workflow; a cross-tenant user-directory disclosure; the production backend for all tenants on a single unmanaged machine; one shared database behind every tenant with no isolation; and a blind server-side request forgery.
What changed.
The direct exposure closes with a mechanical fix: apply the role guard the codebase already enforces elsewhere to every internal route. The blast radius closes by moving the backend onto managed, per-tenant-isolated infrastructure. Fifteen validated positive controls were credited, including five guardrail controls on the AI assistant that held on every probe.
Extend the existing admin-role guard to every internal route; enforce maker-checker on the approval workflow.
Move the backend onto managed, per-tenant-isolated compute; add an authorization regression test.
Re-verify each remediation and re-run the authorization regression suite.
“there is no “regular user” tier that is actually contained.”Most significant observation, application penetration test report
What the client received.
- Validated findings, proven live and human-reviewed
- Three end-to-end attack chains
- Fifteen credited positive controls, five on the AI assistant
- Remediation roadmap: immediate, 30–90 days, retest
- Full re-verification and authorization regression suite as closing step
Prepared by TitanDef offensive security team
Find out what an adversary already sees.
Focused engagements run 5 to 7 business days, with a 72-hour first-findings commitment. Powered by frontier AI models; every finding validated by a senior human.