IDOR via Comma-Injection: How Concatenating Two IDs Leaked Cross-Tenant PII

A multi-tenant document vault enforced a real server-side tenant-ownership check on its permission-grant endpoint - and it was still bypassable. The authorization layer read user_group_id as a single value; the ACL writer split the same string on commas and processed every element. Sending two IDs joined by a comma, victim first, granted an external account access across the tenant boundary and…