CPE
Authenticated MailWatch users can perform unauthorized release or deletion of arbitrary quarantined messages across all domains due to an insufficient ownership check in the quarantine action endpoint.