Ahmed Bouhuolia e18e61000d fix(server): prevent cross-tenant attachment access (IDOR) ...

Add tenant-scoped document lookup with throwIfNotFound() before S3
operations in GetAttachment, DeleteAttachment, and
GetAttachmentPresignedUrl services. This prevents users from reading,
deleting, or generating presigned URLs for attachments belonging to
other tenants.

Also adds RequirePermission decorators to the three attachment
endpoints and introduces Attachment ability subject with View and
Delete actions.

GHSA-rc4v-wq22-v6cf

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-15 14:47:18 +02:00

..

server

fix(server): prevent cross-tenant attachment access (IDOR)

2026-05-15 14:47:18 +02:00

webapp

chore(webapp): add format and format:check scripts

2026-03-27 18:21:23 +02:00