A vulnerability in Claris FileMaker Server's XML Web Publishing Engine allows attackers to bypass authorization checks via a client-controlled X-FMI-PE-ExtendedPrivilege header. Researchers recommend restricting external access to /fmi/xml until patches are applied and consulting Claris security guidance for fixed versions.