globex, role member (uid 20).This is a small multi-tenant SaaS. You are a low-privilege member of globex. There is another tenant, initech, whose admin action you should not be able to run. Everything you legitimately have is scoped to your tenant - but not every endpoint enforces that scope, and not every admin function checks your real role. Some endpoints are correctly protected; those are decoys.
/m02-p/method/tenant-portal/api/documents — your documents/m02-p/method/tenant-portal/api/search?q= — search documents/m02-p/method/tenant-portal/api/documents/<id> — open a document/m02-p/method/tenant-portal/api/tenants/<tenant>/members — tenant members/m02-p/method/tenant-portal/api/tenants/<tenant>/billing — tenant billing/m02-p/method/tenant-portal/api/tenants/<tenant>/admin/audit — admin audit log/m02-p/method/tenant-portal/api/tenants/<tenant>/admin/rotate-keys — admin key rotation (POST)Method: start with a list/search response to harvest object references you were not given, use a direct object reference to read another tenant's data, and let what you read point you at the admin action. Reaching another tenant's admin action completes this lab.