Employees with Any Permissions Can Create App with Full Permissions and Perform any API Action

Summary

By changing the POST parameters of an OAuth authentication call, it was possible to get full permissions to an administration for which the user has limited access. With the fix in place, access will be denied when the administration id is changed.