The Agent Who Saw Too Much

A self-registered 'football agent' read live match data, downloaded internal documents, and pulled broadcast RTMP stream keys — all without a single assigned role. The frontend said Access Denied; the backend served everything. Reconstruct the broken-authorization chain across Entra sign-ins, web/API logs, cloud audit, and the perimeter firewall.