TicketingA recursive merge on user-controlled ticket JSON allowed prototype pollution, setting admin to reach the admin page.
QuotesA cookie-driven object merge gave prototype pollution. Polluting a subscribed flag unlocked the gated quote that held the flag.