Zoho ManageEngine SharePoint Manager Plus prior to 4329 allows account takeover because authorization is mishandled.
zohocorp manageengine sharepoint manager plus -