During a pentest of a relatively large platform, we (@Retr0x00 ) uncovered vulnerability chain.
An unauthenticated API endpoint exposed full PII of +110K customer records.
A high-impact BAC combined with a lower-impact IDOR, resulting in a Critical-severity finding.
[1/2]