PT-2025-36611

Impact An unauthenticated attacker with access to the back-office URL can manipulate the id employee and reset token parameters to enumerate valid back-office employee email addresses. Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of...