Multiple issues involving authorization, tenant isolation, and resource exhaustion allow members or unauthenticated attackers to abuse several features. These include NAT, DDNS, OAuth, cron, and server transfer. Specifically, attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, and create executable schedules without exec scope. Additionally, memory exhaustion can be triggered via buffered NAT requests.