# [Vulnerability type] in [feature] allows [impact]

## Summary

Briefly explain the affected security boundary, the attack, and the demonstrated impact.

## Program and asset

- Program:
- Affected asset:
- Endpoint or feature:
- Tested on:
- Account or role used:

## Severity

- Suggested severity:
- CVSS vector, if required:
- Severity rationale:

Explain exploitability and business impact. Do not rely on the score alone.

## Prerequisites

List the access, role, data, or application state needed before reproduction.

## Steps to reproduce

1. Sign in as `[role/account]`.
2. Navigate to `[feature]`.
3. Send the following request:

```http
METHOD /path HTTP/1.1
Host: target.example
Authorization: [redacted]
Content-Type: application/json

{}
```

4. Change `[specific value]` to `[test value]`.
5. Observe `[result]`.

## Observed result

State exactly what happened and include the smallest evidence needed to verify it.

## Expected result

Describe the authorization, validation, isolation, or other control that should have blocked the action.

## Impact

Explain what an attacker can achieve, which users or data are affected, and the realistic limits of the demonstrated attack.

## Evidence

- Request and response:
- Screenshot or recording:
- Callback or log evidence:
- Negative control:

Remove tokens, personal data, and unrelated secrets before submission.

## Remediation

Describe the root-cause fix first. Add defense-in-depth measures separately.

## Retest guidance

List the original request, obvious bypasses, adjacent endpoints, roles, and state transitions that should be checked after remediation.