Information Disclosure And Elevation Of Priveleges

Loopback is vulnerable to elevation of privilege attacks and information disclosure. This is possible because ACL relations are not enforced. This means that if a malicious user has user group relation, it may allow the group owner to view all user tokens in that group. They can then use that...