The Canvas breach and the cost of multi-tenant blast radius

Short summary

ShinyHunters breached Instructure's Canvas LMS through a free-tier sign-up flaw affecting 8,809 schools. The likely vulnerability is Broken Object Level Authorization (BOLA), where free accounts could enumerate and access paid institutions' data by bypassing tenant-scoped checks. The post explains the mechanics with working code and provides a practical testing checklist for multi-tenant SaaS developers.

• •Canvas breach exposed 275M records across 8,809 schools via a free-tier account vulnerability
• •Root cause likely BOLA (Broken Object Level Authorization) — token validation without tenant-scoped object checks
• •Includes practical Python/bash testing code and 4-step security checklist for SaaS developers

Generated with AI, which can make mistakes.