In multi-tenant apps, a common bug is reading tenant_id from the JSON body or query string and then authorizing against that value. Anyone can send tenant_id=other-customer . The tenant for an authorization check must come from the authenticated principal or server-side session — the same place...
Source: [Dev.to](https://dev.to/authbyexample1/pull-the-tenant-from-the-auth-context-not-the-request-body-dag)