Reset password policy isn't consistent with registration / change password policy. #1083531 Valid Input Validation and Logic – 2021-01-22 – 10 CSRF Bypassed on Logout Endpoint #1091403 Valid Cross-Site Request Forgery – 2022-06-17 – 19 Unrestricted Upload of File with Dangerous Type #1081766 Valid Input Validation and Logic – 2021-01-20 – 20 Cloudflare /cdn-cgi/ path allows resizing images from unauthorised sources on enjinusercontent.com #2545994 Valid Command and Code Injection Low 2024-06-19 – 29 Race condition via project team member invitation system. #1108291 Valid Input Validation and Logic – 2022-06-17 – 35 Lack of Tenant Scoping Enables Limited Cross-Tenant Data Querying and Mutation #2327238 Valid Access Control – 2024-01-25 – 41 Authentication token and CSRF token bypass #998457 Valid Access Control – 2022-06-19 $300 44 Race Condition on Create API Function #2682392 Valid Race Conditions None 2024-10-15 – 45 Host header injection leads to account takeover #1623672 Duplicate Injection and Smuggling High 2024-10-15 – 47 Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log In #2312320 Valid Authentication – 2024-01-19 – 48 Unauthenticated File Upload to CDN #3589247 Valid Access Control Medium 2026-05-18 – 56 Revocation API Token by Bypassing The XSRF Token #2312217 Valid Cross-Site Request Forgery – 2024-01-19 – 60 Unauthenticated GraphQL access by prepending __schema to private operations #3452015 Valid Authentication Medium 2025-12-05 $500 76