- Shipped
- September 17, 2026 at 4:08 AM UTC
- Author
- Kamo
- Commit
- 7ece2de
GET **************** called **************** which read the access rows for any mailbox id. Every other access operation (update, delete, grant, revoke) loads the mailbox and refuses one from another organization; this one did not, so a session in ANY organization could list who has access to another tenant's shared mailbox (member ids and who granted them) given its UUID. listAccess now takes the caller's org and checks it the same way as its siblings: an unknown mailbox is 404, another organization's is 400 "Shared mailbox does not belong to this org", and neither reads the access rows. The only caller is this endpoint. **************** drives the controller; with the org check removed its cross-org test fails.