Hey everyone, just wanted to vent a bit and get some second opinions in this vuln report

I recently found an IDOR on an anonymous cart endpoint. It essentially allows an unauthenticated attacker to view and completely delete other users' cart contents. Because it directly affects other users' data (even if anonymous) and disrupts their shopping flow, I initially rated the severity as High.

However, right before submitting my report on Intigriti, their new AI review tool flagged it. It forced a downgrade to Medium, stating: "The selected severity is High, but the impact of viewing and deleting anonymous cart contents corresponds to Medium severity (CVSS 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)."

Has anyone else experienced similar friction with AI reviewers on these platforms? Do you think the AI's CVSS 5.3 assessment is actually accurate here, or is there a strong argument to push this back to High during the triage process?

Any insights or tips on how to argue this with the human triager would be appreciated!