Cirque du Soleil app gives attackers same admin rights as operators

The developers of the app did not implement any form of authentication.

You can read the full article here.