Morris Baumgarten-Egemole

An improper access check allows unauthorized users to perform mutation actions in webservice endpoints. This occurs because the Access Control List (ACL) checks are inconsistent, permitting actions via the webservice that are otherwise restricted within the backend user interface.

Improper validation in the language override feature allows for a generic Cross-Site Scripting (XSS) vector. XSS is a type of security flaw where malicious scripts are injected into trusted websites.

Insufficient state checks create a vector that allows the bypass of two-factor authentication (2FA) checks.