Database Queries Scoped to Tenant

A database query in a multi-tenant route that omits the tenant ID filter returns records from all tenants — every authenticated user can read every organization's data if they can reach the endpoint. CWE-284 (Improper Access Control) and CWE-639 (Authorization Bypass Through User-Controlled Key) apply when the query is not scoped to the active tenant. OWASP A01 (Broken Access Control) covers the failure. NIST 800-53 AC-3 and SC-4 (Information in Shared Resources) require that queries not cross tenant boundaries. List endpoints (findMany, SELECT *) without a tenant filter are the highest-risk variant — a single call returns the entire dataset.

Include the tenant filter in the WHERE clause of every database query in a tenant-scoped context. Derive the tenant ID from the session, never from request parameters.

// app/api/projects/route.ts (multi-tenant)
const orgId = session.user.activeOrgId; // From session — not from params

const projects = await db.project.findMany({
  where: {
    orgId,           // Tenant scope — required on every query
    archived: false,
  },
});

Consider a Prisma middleware or query extension that automatically appends the tenant filter when a tenant context is active — this prevents new routes from accidentally omitting the filter.