Authorization Flaws Expose Sensitive Data Across APIs and GraphQL Endpoints

OWASP's API Security Top 10 identifies broken object-level and function-level authorization, excessive data exposure, security misconfiguration, and unsafe trust boundaries as leading API risks, warning that business logic abuse and operational gaps often turn ordinary endpoints into high-impact exposures. Those patterns were reflected in newly disclosed incidents involving both enterprise software and consumer-facing platforms, where low-privileged access was enough to reach data and functions intended for administrators or other users.

In CVE-2026-46515, Frogman versions before 1.6.3 allowed users with only PERM_READ privileges to access administrative PBX data through MCP and HTTP APIs, including AMI manager secrets, outbound dial PINs, SIP secrets, backup paths, CDR history, and even root SSH connection commands; the flaw also enabled arbitrary execution of saved GraphQL queries and was rated CVSS 9.3. Separately, a bug bounty report on Target's Academy platform showed how two seemingly low-risk APIs could be chained to enumerate users and expose PII at scale, underscoring how weak authorization controls across interconnected endpoints can escalate routine API functionality into serious data disclosure.