essentially vulnerabilities allow spoofing posts (with a really simple exploit) and reading contents of any arbitrary post that the instance knows about (even external ones)
(there are also some other vulnerabilities, like imports working with files belonging to other people, as long you know the id of the file, but fae sees those as pretty minor unless fae is missing something)
1
1