Cross-user data breach is the exposure of data belonging to one user to another user who should not have access. It usually results from weak authorization checks, insecure object references, or flawed request handling. In SaaS platforms, the risk increases when workflows reuse identifiers across accounts or tenants.
Expanded Definition
Cross-user data breach is a broken authorization outcome, not just a data leak. It occurs when a system returns one user’s records, objects, or workflow state to another authenticated user who lacks a valid entitlement. In NHI-heavy environments, the failure often appears in API layers, background jobs, or agent-triggered workflows where identity context is reused incorrectly across sessions, tenants, or tool calls. That makes it closely related to insecure direct object references, confused-deputy behavior, and missing object-level access checks, as described in NIST SP 800-53 Rev 5 Security and Privacy Controls.
Definitions vary across vendors on whether the term should be limited to multi-tenant SaaS incidents or also include single-tenant privilege boundary failures. NHI Management Group uses it broadly to cover any user-to-user exposure caused by authorization logic, request handling, or identity binding mistakes. The distinction matters because the root cause may be in application logic, but the blast radius is determined by how identities, tokens, and object references are scoped. The most common misapplication is calling every access-control bug a cross-user breach, which occurs when the system exposes data across users but the actual failure is at the network, storage, or encryption layer.
Examples and Use Cases
Implementing user-level isolation rigorously often introduces more validation, more state handling, and more test coverage, requiring organisations to weigh tighter safety against higher development and operations overhead.
- A SaaS support portal reuses a case ID across tenants, and an authenticated customer can view another tenant’s tickets after guessing the object reference.
- An AI assistant connected to a CRM retrieves prior customer notes through a shared tool session, similar to the exposure patterns discussed in the OmniGPT Breach — 34M Conversations Exposed.
- A workflow engine stores per-user exports in a common bucket but fails to verify ownership before download, causing one user to retrieve another’s file.
- A billing API accepts sequential identifiers and returns another account’s invoice because object-level checks were skipped after authentication.
- In research on exposed credentials and rapid attacker action, NHIMG’s DeepSeek breach shows how fast sensitive systems can become exploitable when controls are weak, even before a user notices cross-account exposure.
These scenarios align with the object-level authorization problems highlighted in the Anthropic — first AI-orchestrated cyber espionage campaign report, where tool use and identity context can be abused when boundaries are too loose.
Why It Matters in NHI Security
Cross-user data breach becomes especially dangerous in NHI security because service accounts, agents, and automations can move faster than human reviewers and can repeat a flaw at scale. A single broken check in an agentic workflow may expose many records across many users before detection, especially when shared secrets or pooled tokens are used to access downstream systems. NHIMG’s The 52 NHI Breaches Report and Ultimate Guide to NHIs — Key Research and Survey Results show that compromised or insufficiently secured NHIs are common enough to make authorization discipline a board-level concern.
When a cross-user breach is caused by an NHI, incident response must answer two questions at once: which users were exposed, and which machine identity or agent path made the exposure possible. The 2024 ESG research cited by NHIMG reports that 72% of organisations have experienced or suspect a breach of non-human identities, reinforcing how often NHI weaknesses become user-visible failures. In practice, cross-user exposure is often only discovered after a customer complaint, a support escalation, or an anomaly in audit logs, at which point the authorization flaw becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Cross-user exposure usually stems from broken object-level authorization in NHI-driven flows. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access control is the core defense against user-to-user data exposure. |
| NIST SP 800-63 | IAL2 | Assurance in identity proofing and binding reduces mistaken cross-user access paths. |
| NIST Zero Trust (SP 800-207) | JIT | Zero trust requires verifying each access request, not trusting prior session context. |
| OWASP Agentic AI Top 10 | AGENT-04 | Agent tool access can leak data across users when context is shared improperly. |
Bind authenticated identities to the correct account context before any data retrieval or workflow execution.
Related resources from NHI Mgmt Group
- Who is accountable when recycled breach data triggers user confusion?
- How should security teams reduce phishing and account takeover risk after a third-party analytics breach exposes user profile data?
- Why do AI agents make data access reviews harder than human user reviews?
- How should security teams prevent cross-tenant data leaks in multi-tenant apps?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
