State licences are read and replaced only within the caller's organization (SITP TP16)

Shipped

October 18, 2026 at 6:42 PM UTC

Author

Kamo

Commit

d79a0c3

GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete another organization's loan officer's licences and NMLS id. Another organization's member now reads as missing (404) and is never written. directory_get_state_licensing / **************** reach these.