A missing authentication check on a table query endpoint. One defect, and a different blast radius inside every tenant.