business-logic

Abusing accounts tied to deactivated organisations to reach a hidden signup endpoint, bypassing an invite-only model to create arbitrary accounts and self-select privileged roles.

A mass assignment vulnerability in a healthcare onboarding flow where a single unvalidated ID field let an attacker control the primary key sequence and disable patient creation platform-wide.