- Shipped
- July 6, 2026 at 5:39 PM UTC
- Author
- Kamo
- Commit
- 7a9d8b9
The generic imaging byte endpoints (download / stream / bulk-download / thumbnail) and the binder aggregation authorized only on org + a numeric clearance ceiling — no per-party check — so any member cleared to CONFIDENTIAL could pull ANY org party's mortgage PII (SSN cards, tax returns, appraisals) by iterating the guessable imgId exposed in MemberDocumentDTO. Refuse ACCOUNT_MEMBER_VAULT and LOAN assoc images on every generic byte path (and block adding them to a binder, whose renderer re-reads bytes with no re-check). Verified via a full fetch-path map that NO shipping client fetches these bytes today (the Account Documents tab is metadata+adjudication only; DocManager only mounts assoc ACCOUNT/SERVICE_ORDER; the borrower portal only uploads), so nothing breaks. Per-party byte access, when a viewer is built, must go through a per-party-authorized MLOS endpoint — not the generic org+clearance path.