In isolation these are a high, a medium, and a critical. Chained, an attacker starts unauthenticated, obtains a session through the exposed staging console, then abuses the cross-tenant flaw to read every customer's policy and claims documents. The critical link was only reachable behind the login — a public-surface scan stops at the console.