Summary by oversudo
The MMGIS webhooks API (create/list/update endpoints, admin-only) lacked authentication and authorization checks. Any unauthenticated user could create, view, or modify webhook configurations without a token, cookie, or auth header — potentially allowing data exfiltration or tampering via malicious webhooks. Reported and remediated.