[jamiesonbecker]

Perhaps it's semantics, but you're right - it's not a security hole.

It's worse.

Exceeding authorization is exploiting an existing hole.