SQL Injection in IBM access control panel & Broken access in admin panel

Summary

An application endpoint was found to be vulnerable to SQL Injection caused by a lack of sanitation on the client_id parameter. An adversary would eventually be able to read sensitive data from the database, or modify it as well as to execute administration operations. This was reported to IBM and remediated.