GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPerson

Summary

@bubbounty discovered an Insecure Direct Object Reference (IDOR) vulnerability that allowed someone with prior Admin access to a Stripe account to add a co-founder to a Stripe Atlas application belonging to the merchant account they used to administer. The issue has been addressed by only allowing the addition of co-founders to Atlas applications by an authorized user.

Note: This bug was accepted and received before our minimum bounty amounts were increased on August 25, 2021.