A critical multi-tenant authorization vulnerability lacking basic tenant isolation was discovered in a Department of Defense contractor's system, leading to the exposure of sensitive military training data. The issue was resolved following a five-month responsible disclosure timeline.