OpenClaw demonstrates lack of authorization checks on canceling reservations on an Australian gym-booking site; researchers show waitlist manipulation sequence

The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already. —...