❌ Critical: Broken Function-Level Authorization

Endpoint: DELETE /api/api-keys/:id
CWE: CWE-285 (Improper Authorization)
OWASP: API5:2023-Broken Function Level Authorization

Issue: Regular users can delete API keys created by administrators.
       No role-based access control on DELETE operations.

Evidence:
- Admin (admin@acme.com) created API key: c93533da-4cbb-...
- Regular user (bob@acme.com, role: user) sent DELETE request
- Response: 200 OK {"message":"API key revoked"}
- Verification: Admin confirmed key no longer exists

Impact:
- Critical privilege escalation
- Regular users can disrupt operations by deleting admin API keys
- Breaks principle of least privilege
- Enables service disruption attacks

❌ Critical: Broken Object Level Authorization

Endpoint: GET /api/emails/{id}
CWE: CWE-639 (Authorization Bypass Through User-Controlled Key)
OWASP: API1:2023-Broken Object Level Authorization

Issue: Users can access emails belonging to other organizations
       by manipulating the email ID in the request path.

Evidence:
- Attacker: bob@acme.com (Org: 30484ee6-d0ae-...)
- Victim: admin@techstart.com (Org: 651c50a4-6e85-...)
- Request: GET /api/emails/2580b047-ca95-41ae-acf8-e2daeb699884
- Response: 200 OK with victim's full email data

Data Exposed:
- from, to, subject, text content
- organizationId, status, timestamps

Impact:
- Complete breach of multi-tenant data isolation
- Confidential email content exposed to unauthorized parties
- Attackers can enumerate and read all emails across organizations

// Normal request
{"username": "admin"}

// Injection payloads
{"username": {"$ne": null}}      // Always true
{"username": {"$gt": ""}}        // Greater than empty
{"username": {"$regex": ".*"}}   // Regex match all

❌ High: NoSQL Injection

Endpoint: POST /api/v1/users/login
Parameter: username, password (request body)
CWE: CWE-943 (Improper Neutralization of Special Elements in Data Query Logic)
OWASP: API8:2023-Injection

Issue: Login endpoint accepts MongoDB operators in JSON body,
       allowing authentication bypass without valid credentials.

Evidence:
- Normal request: {"username": "admin", "password": "secret"}
- Attack payload: {"username": {"$ne": null}, "password": {"$ne": null}}
- Response: 200 OK with valid JWT token for first user in database

Verification:
- Decoded JWT shows: {"sub": "507f1f77bcf86cd799439011", "role": "admin"}
- Attacker gained admin access without knowing any credentials

Impact:
- Complete authentication bypass
- Unauthorized access to any account
- Potential data exfiltration as admin user
- No audit trail linking attacker to legitimate user