- Shipped
- September 23, 2026 at 2:16 AM UTC
- Author
- Kamo
- Commit
- aa86da7
GET /api/kb/media/{mediaId}/url looked the row up by uid alone (KbMediaService.getPresignedUrl -> **************** unlike every other media read here (presignAll, getMedia -> **************** Any member holding VIEW_KB_ARTICLES in their own org — a common right, and KBService's hasRight fails closed but that was never the gate that mattered here — could mint a one-hour presigned MinIO URL for any other org's media by uid, with no org check anywhere in the query. The rule now: the same org-scoped lookup every sibling method already uses. Test: KbMediaServiceOrgScopeTest, verified red against the pre-fix method (a plain assertThrows was not enough — an unstubbed mock also answers Optional.empty(), so the test additionally verifies the org-scoped repository method was the one actually called).