Hey team, there is an IDOR bug, which allows me to add an invoice to any retainer I wish, even if the retainer belongs to another app/subdomain.
In B open this link: https://SUBDOMAIN.harvestapp.com/invoices/new?invoice[client_id]=5678&invoice[kind]=retainer&invoice[retainer_id]=1234
Here 5678 needs to be a valid client id for account B. Then simply fill out the invoice form and save it.
Now in account A go to
https://[SUBDOMAIN].harvestapp.com/retainers/1234 and you will see that the invoice from account B was added to this retainer.