The Helpful Exporter

An internal export service holds a service account with read access to every tenant's data so it can render PDFs. It accepts a reportId from any signed-in caller, loads that report with its own credential, and returns the file. What is the flaw class?

A time-of-check to time-of-use race between the report lookup and the render step

A confused deputy: the service uses its own broad authority on a caller-chosen target

Privilege escalation through role assignment, since callers can grant themselves the service role

A replay attack, because the same export request can be submitted again with an old token