GRAPHQL 1 The Red Agent POV Exploiting Broken Object-Level Authorization in an Airline GraphQL API Jun 29, 2026