Lack of Tenant Scoping Enables Limited Cross-Tenant Data Querying and Mutation

Summary

@tushar_rec0n was able to demonstrate on the Enjin Platform that it was possible, for certain queries and mutations, to query and mutate data cross-tenant (ie. to query or mutate someone else's data).

It's worth noting that the Enjin Platform does have a plethora of queries and mutations that are intended to work cross-tenant, although this report specifically highlighted ones that were not intended to do so.

A full assessment of the vulnerability was conducted and, outside of the three duplicate reports, we identified this vulnerability had not been used by anyone else.