Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server