A Binary Security researcher disclosed five privilege-escalation flaws in Azure Logic Apps API Connections that could enable use of another tenant’s connection credentials. Shared API Management requests exposed mismatches between connection-ownership checks and the actual execution address, including validation before path normalization. Related routes and regressions appeared after some fixes, but the researcher says all reported flaws were fixed and earned $200,000 in total bounties. Potential backend targets included Key Vault, SQL and external SaaS services, with actual access bounded by the permissions of each stored credential.