- Shipped
- August 11, 2026 at 12:10 AM UTC
- Author
- Kamo
- Commit
- 21eba95
AccountSubscription deliberately separates the payer from the organization whose members consume the seats, and auto-provisioned accounts sit on the top-level KamoCRM org while targeting the sub-org. The interceptor nonetheless demanded account.organization == callerOrg, so every sub-org's billing 403'd across the board: GET /accounts returned the account and every drill-down — subscriptions, payment methods, invoices, members — then refused it. Ownership now uses the same union **************** already uses to decide what to list, so what is listed and what is reachable cannot disagree.