Severity is a poor predictor

CVSS scores each issue alone. An attacker doesn’t. Three low-severity findings in the same flow can add up to a full account takeover, and no single ticket will ever show it.

A typical chain

A verbose error leaks an internal id. A predictable job id turns that into a guessable URL. An export that trusts the request body then returns another tenant’s data.

Why teams miss it

Each step lands in a different backlog, with a different owner, and all of them are marked low.

What to do about it

Test flows, not endpoints. When you fix a chain, fix the link that breaks the most paths and add a regression test for the whole sequence.