Satisfy-across confused-deputy IDOR + account party self-heal

Shipped

July 6, 2026 at 1:41 AM UTC

Author

Kamo

Commit

282105e

- HIGH: satisfy-across gated on the path partyId but fanned out over the DOCUMENT's own party downstream; verify the document belongs to the authorized party (same org) before relaying, else 403 — closes cross-borrower state-mutation + info-leak. - listParties self-heals party links across the account's loans so the tab populates.