From Editor to Owner: One Writable Field Was Enough to Take Over an Organization

Severity: HighBounty: ~$315Platform: Standoff365 This one came down to a single field that should never have been writable by an editor: Firm[user_id] The application had a clear permission model. An