A cross-tenant vulnerability is a flaw in a multi-tenant cloud service that lets data, requests, or actions escape one tenant’s boundary and affect another tenant. In a shared SaaS platform, each customer is supposed to be isolated by identity checks, authorization rules, and backend data controls. When any of those controls fail, one tenant may be able to read records, trigger workflows, or modify settings belonging to another tenant.
This matters because tenant isolation is a core security guarantee in business cloud systems. A single boundary break can expose confidential data, weaken privilege separation, and damage trust in the platform. In real attacks, these bugs are often found in access-control logic, API handling, connector behavior, or data-layer permissions. Defenders look for them by testing with separate tenants, verifying every request is scoped correctly, and reviewing cross-tenant paths in services, integrations, and automation tools.