- Shipped
- September 23, 2026 at 8:37 AM UTC
- Author
- Kamo
- Commit
- 4635f6e
The settings page always sent a member without MANAGE_DOCS_SETTINGS away, but ten mutation endpoints in ImagingSettingsController never asked themselves: canManage(member) already existed and already gated /assoc-config and /versioning, and simply was not called from doc-types create/update/toggle, stacking-orders create/update/delete, or stacking-order-details add/update/delete/reorder. Any member who could reach the API directly (not only through the page) could create, rename or delete an organization's document taxonomy with VIEW_DOCUMENTS alone. Add the same canManage(member) check these endpoints' siblings already use.