- Shipped
- August 9, 2026 at 3:03 AM UTC
- Author
- Kamo
- Commit
- b114fca
/api/billing/accounts scopes its listing by the X-Org-Id header, but every route beneath /{accountUid} took the id straight from the path and never checked who owned it — 24 handlers covering plan changes, seat counts, cancellation, payment methods and subscription members. Any member of any organization could read or rewrite another organization billing by naming its account id. The service is ClusterIP and only reachable through the kamo-internal proxy, so this needed a session rather than cluster access: the proxy attaches X-Org-Id from that session and forwards whatever path it is handed. An interceptor rather than 24 edits, so a route added later is covered by default — the previous arrangement was one omission per endpoint. God mode passes through, since a platform admin acting across orgs is the one caller for whom that is legitimate, and an unresolvable account id is left to the handler so it can answer 404. Deliberately NOT adding a finance-right check here. The Plans and Billing tab is gated on "is this me, or am I the organization owner", not on a right, so requiring MANAGE_ORG_FINANCES would lock every ordinary member out of their own subscription. Enforcing that within-org rule server-side is a separate question about who may change whose subscription, and it should be decided rather than guessed. 7 tests cover the gate; 89 pass overall.