You mentioned "creating a new record", which indicates a POST request.

I believe this only a vulnerability if the server responds to jsonp requests in GET requests.