SEC-0002: Tenant Authentication Cache Fix
| Date | Author | Severity |
|---|---|---|
| 2026-03-18 | Fabian Beyerlein | HIGH |
Problem
Tenant Authentication Repository did not verify tenant association of stored sessions
- User A from Tenant A could have used his session on Tenant B if it was cached, even though they do not belong to Tenant B
Fix
- Store OrgID in cache entry
- Verify OrgID in cache entry against the accessed OrgID upon retrieval
Files
backend/apps/solaris/modules/authtenant/infra/ent/cached_basic_repo.go