access-control 2 Auth Token Theft via CORS Misconfiguration Mar 8, 2025 Privilege Escalation via Chat Permissions Bypass Feb 7, 2024