Vend VDP: Race Condition : Exploiting the loyalty claim https://xxx.vendhq.com/loyalty/claim/email/xxxxx url and gain x amount of loyalty bonus/cash

Hey Team! I love loyalty bonuses, that turns first time users into returning customers , but sometimes loyalty can be exploited, just like in this chase. LT:DR A firtstime loyalty customer will get x times the amount of loyalty bonus from the story by racing the loyalty link x amount of times in...

Vend VDP: Improper access control on adding a Register to an Outlet

Summary: User without permissions to add a Register to an Outlet can bypass this restriction and add a Register to an Outlet. Description: I do not know which permission exactly controls this action, I tested this against default Cashier role. User with default Cashier role has no permission to a...