Beyond the Scope: Security Testing of Permission Management in Team Workspaces

Team workspaces like Google Workspace and Microsoft OneDrive allow third-party applications called add-ons to extend their functionality, but researchers found that these add-ons can bypass permission isolation (access control rules set by administrators) in multi-user environments, potentially letting them escalate privileges (gain higher access levels than intended). A testing tool called TAI discovered 41 problematic interactions that could allow permission escalation across these platforms.