django-access-review

Django access control auditing involves tracing endpoints from view to ORM query to verify where permission decorators, mixins, or DRF permissions restrict data access to the intended user or tenant, preventing unauthorized modification of user data.

Tenant isolation in Django restricts data access to specific tenants. It is enforced by scoping the get_queryset method in DRF viewsets, ensuring ORM queries filter objects so users only access their own tenant's resources.

Reviewing DRF viewsets for authorization involves evaluating how has_object_permission is implemented and whether get_queryset is scoped to the user or tenant, preventing unauthorized access or modification of user data.

Yes, this access control audit covers multi-tenant Django applications by systematically reviewing ownership models and tenant isolation scenarios across views, DRF viewsets, and ORM queries to prevent unauthorized tenant data access.

The best way to fix IDOR vulnerabilities in Django ORM queries is to apply evidence-based remediation that strictly scopes get_queryset to the authenticated user or tenant, ensuring all data access is properly restricted.

Django views may expose user data when permission decorators only check authentication but fail to scope ORM queries or implement has_object_permission, leaving gaps in object-level authorization that allow IDOR attacks.