IDOR · critical
The export that handed out the owner role
An export-creation route that never checks which organisation you belong to, a notification parameter nobody validates, and an archive that ships the service tokens with it. Full chain to account takeover, zero victim interaction.
· 12 min read $2.5k - $5k