Exceed the maximum number of subscribers using Race Condition

Summary

A race condition vulnerability was discovered in the SingleStore control panel that allowed bypassing the maximum limit of five subscribers for alerts. By sending multiple concurrent POST requests to the CreateAlertReceivers endpoint with different email addresses, an unlimited number of subscribers could be added despite the UI displaying a restriction message.

The vulnerability was validated, triaged, and assigned a Low severity rating by the SingleStore security team. The issue has been patched and deployed to production.