A security researcher disclosed five critical cross-tenant elevation-of-privilege vulnerabilities in Azure API Connections, part of Logic Apps, that allowed full compromise of other tenants’ connected backends such as Key Vaults and Azure SQL databases. The flaws involved path traversal and runtime URL validation bypasses, and the researcher earned $200,000 for the reports. Microsoft fixed the issues, though some fixes were bypassed or addressed by blocking vulnerable endpoints.