This week I've found a privacy issue in an app we use for our family. (intentional that broadly to not give hints)
The root cause was painfully simple: something belonged to the same group, so it was considered authorized. But access is more than a group.
