Comment by shawabawa3

This is like 80% of security vulnerability reports we receive at my current job

Long convoluted ways of saying "if you authorize X to do Y and attackers take X, they can then do Y"