Vulnerability analysis, root-cause writeups, and reproduction notes.
A permission check is computed but never enforced, letting a Subscriber-level account pull data reserved for administrators.