- Shipped
- August 10, 2026 at 11:45 PM UTC
- Author
- Kamo
- Commit
- 1144b78
AccountOrgScopeInterceptor short-circuited every org and member check on the raw X-God-Mode-Active header, and kamo-internal's billing proxy copies that header straight off the inbound browser request. Any signed-in member could therefore read or rewrite any organization's payment methods, invoices, subscriptions and licenses from a console fetch. The storage endpoints leaked the same way: /storage/summary and /storage/history honour ?orgId= on the bare header and carry no @PlatformAdminOnly, so the class javadoc's claim that "its interceptor re-checks the claim against the database" was describing an intent the code never implemented. Both now go through GodModeVerifier, which mirrors what PlatformAdminInterceptor already does correctly: users.is_god read from the database AND the active claim on the request. Neither half suffices alone — the flag alone would put every god permanently in god mode, and the header alone is forgeable.