Your API trusts the ID in the request
Broken Object Level Authorization

An attacker installs the mobile app, creates a real account, and points it at a local proxy like mitmproxy or Burp.

1. 1
   Capture the contract

   They tap around the app for five minutes and watch every request fly past the proxy. The API shape writes itself: /api/v2/orders/{id}, /api/v2/messages/{id}, /api/v2/uploads/{id}.
2. 2
   Swap the ID

   They replay their own request with a different numeric ID. The server returns somebody else's order — shipping address, last four of the card, the works.
3. 3
   Script the range

   A tiny loop iterates 1 through 500000. Every response is a real customer. GraphQL makes it even easier: one query with an array of node IDs returns them all in a single round trip.
4. 4
   Move laterally

   The same trick works on /api/v2/uploads — signed URLs to private documents. And on /api/v2/messages — private DMs. The bug isn't in one route. It is the whole API.

The attacker dumps the entire production dataset through the official API, using a legitimate session. Nothing in the logs looks unusual — just a paying customer asking for records, many records, very quickly.

// graphql/resolvers/order.ts
export const orderResolvers = {
  Query: {
    order: async (_parent, { id }, ctx) => {
      // ctx.user exists — they're logged in. Good enough, right?
      return ctx.db.order.findUnique({
        where: { id },
        include: { items: true, shippingAddress: true },
      });
    },
  },
};

// graphql/resolvers/order.ts
export const orderResolvers = {
  Query: {
    order: async (_parent, { id }, ctx) => {
      if (!ctx.user) throw new GraphQLError('Unauthorized');

      const order = await ctx.db.order.findFirst({
        where: {
          id,
          accountId: ctx.user.accountId, // authorization lives in the where clause
        },
        include: { items: true, shippingAddress: true },
      });

      if (!order) throw new GraphQLError('Not found');
      return order;
    },
  },
};

Authentication proves who you are. Authorization proves this specific row is yours. The fix is not a middleware — it is a clause in the database query that ties the object to the session. Never return 403 here; a 404 avoids confirming the object exists.