Ravenna Hub, which lets parents apply and track the status of their kids' applications across thousands of schools, allowed any logged-in user to access the personally identifiable data associated with any other user, including their children.
Source: https://techcrunch.com/2026/02/19/bug-i ... formation/