Unauthenticated GraphQL access by prepending __schema to private operations #3452015 Valid Authentication Medium 2025-12-05 $500 76 Revocation API Token by Bypassing The XSRF Token #2312217 Valid Cross-Site Request Forgery – 2024-01-19 – 60 Unauthenticated File Upload to CDN #3589247 Valid Access Control Medium 2026-05-18 – 56 Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log In #2312320 Valid Authentication – 2024-01-19 – 48 Host header injection leads to account takeover #1623672 Duplicate Injection and Smuggling High 2024-10-15 – 47 Race Condition on Create API Function #2682392 Valid Race Conditions None 2024-10-15 – 45 Authentication token and CSRF token bypass #998457 Valid Access Control – 2022-06-19 $300 44 Lack of Tenant Scoping Enables Limited Cross-Tenant Data Querying and Mutation #2327238 Valid Access Control – 2024-01-25 – 41 Race condition via project team member invitation system. #1108291 Valid Input Validation and Logic – 2022-06-17 – 35 Cloudflare /cdn-cgi/ path allows resizing images from unauthorised sources on enjinusercontent.com #2545994 Valid Command and Code Injection Low 2024-06-19 – 29 Unrestricted Upload of File with Dangerous Type #1081766 Valid Input Validation and Logic – 2021-01-20 – 20 CSRF Bypassed on Logout Endpoint #1091403 Valid Cross-Site Request Forgery – 2022-06-17 – 19 Reset password policy isn't consistent with registration / change password policy. #1083531 Valid Input Validation and Logic – 2021-01-22 – 10