GroovyGate RCE: Root Access Despite a 403 (vulnetic.ai)

Be sure to check your bean validation! If your authorization check lives inside the handler, anything validation does runs before it, under the caller's identity.