- Shipped
- October 18, 2026 at 6:37 PM UTC
- Author
- Kamo
- Commit
- e636779
EmailTemplateController and EmailTemplateCategoryController checked a session alone: any member could list, read, preview, create, edit, archive, duplicate or reset the organization's transactional email templates and categories. Every user endpoint now takes MANAGE_EMAIL_SETTINGS, the right Settings -> Email (Templates tab) is gated on, so nobody who uses the screen loses it. The SYSTEM templates every organization falls back to were reachable by any parentless organization (a test org has no parent); they now answer only to the platform organization (orgs.is_top_level, PlatformOrgResolver). IntegrationSettingsController's organization connection (GET/PUT/DELETE /org, /org/test, /org/sync, and the OAuth url/status/disconnect with member=false) was session-only, so any member could replace or delete the org's CalDAV/CardDAV credentials; it now takes MANAGE_EMAIL_SETTINGS (the CalDAV/CardDAV tab's gate). A member's own connection still needs no right.