An authorization bypass allows low-privileged authenticated users to read the Role-Based Access Control (RBAC) catalog. By querying unprotected security endpoints, attackers can map privileged actions and endpoints to plan privilege escalation. The affected API endpoints are 'GET /security/actions' and 'GET /security/resources', which fail to apply the caller's RBAC policies.