CERYVON
← Back to siteSynthetic demonstration only. This is not a real customer finding, vulnerability disclosure, or claim about a production system.
Logic Risk Pilot — Sample Report
A compact example of how Ceryvon separates business impact, evidence status, technical context, and remediation guidance.
Ownership validation is missing in one cancellation path.
In the synthetic scenario, a standard customer can submit a cancellation request for a booking owned by another customer when a direct resource identifier is supplied. The expected result is denial. The observed result is acceptance.
High impact Reproduced in demoCross-customer action
An unauthorized user could interfere with another customer’s booking, creating operational disruption and trust risk.
Server-side ownership check
Verify the authenticated user’s relationship to the booking before applying any state-changing operation.
Evidence summary
| Item | Result |
|---|---|
| Expected behavior | Deny cancellation when requester is not the booking owner. |
| Observed behavior | Cancellation accepted for a booking owned by a different user. |
| Evidence status | Reproduced in a controlled synthetic demo. |
| Residual risk | Other state-changing booking actions should be reviewed for the same control gap. |