Another company's invoice opens from a forwarded link

Component: Web app – email links (support's guess)

From: Priya Nair, workspace owner, Globex · Received: Tue 21 Oct, 4:02 pm (Sydney)

Hi, one of my team (Sam) clicked a link in an email thread someone forwarded him this morning and it opened an invoice that is NOT ours. It's from a company called Acme Corp, billed to Initech, $4,800. He was logged in to our Globex account when it happened. We have never worked with Acme. I think the link logged him into their account somehow?? If other companies can see our invoices that is a serious problem for us, our finance team is already asking. Please call me.

Priya Sent from my iPhone

Support note (Dana K.): Priya forwarded us the email. Opened its link while signed in as support and it loads, but staff accounts see every organization, so that tells us nothing. I don't have a Globex login to try it as Sam. Possibly a cookie/session mix-up from the email link? Acme has not been told yet.

Attachments: screenshot (Sam's): invoice page with "Acme Corp" header, INV-1042, Initech, $4,800.00, status Sent. Address bar cropped out.

Ask: find out whether a signed-in customer can reach another organization's invoices, and fix it. Acme's own team must be able to use their invoices exactly as today.