Enno Gelhaus

Arbitrary file read and backend crash through unrestricted provider method calls

Forged signed tokens let any registered user take over other users and organizations

Path traversal in post media lets any registered user read server files

Channel tokens and organization API key exposed in API responses

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions