Threat model and vulnerability check for a customer portal

I have a customer portal with user accounts, file upload and some admin functions. I want a freelancer to make a threat model first and then check the most likely weak points. Please focus on the real risk, not only theory. The portal is already running, so I need advice that I can use fast. A mix of threat modeling and vulnerability assessment is what I need here. If you can also point out bad auth design or missing access control, that is very helpful. Budget is fixed and the task should stay small to medium, not a full pentest of everything.