- Shipped
- September 23, 2026 at 12:34 PM UTC
- Author
- Kamo
- Commit
- d49e1e6
**************** compared only security levels and the editor's owner flag, never the two members' organizations. Its one caller today (SecurityService's MemberSecurityController PATCH /member-security/{id}/access) already scopes the target to the session's organization, but this method is a public service call reachable from any repo that depends on the library, so it must not rely on that alone. Without this, an owner of org A holding a member id from org B could set that org's access level or promote/demote its owners by id alone. Defense in depth for the controller-side fix landing alongside it in securityservice. No signature change, so no other caller needs updating.