Exploiting a Business Logic Flaw: How an Empty Array Caused Account Lockout and System Pollution

Overview During a security assessment of a widely-used customer support platform (which shall remain unnamed due to disclosure policies), I discovered a critical business logic vulnerability in the agent invitation API. By manipulating a single param...