Satisfy-across confused-deputy IDOR + account party self-heal

FixSecurityService
Ya
6 Julai 2026, 01:41 UTC
Mwandishi
Kamo
Ahadi ya
282105e

- HIGH: satisfy-across gated on the path partyId but fanned out over the DOCUMENT's own party downstream; verify the document belongs to the authorized party (same org) before relaying, else 403 — closes cross-borrower state-mutation + info-leak. - listParties self-heals party links across the account's loans so the tab populates.

Mabadiliko yote

Je, unaona nini kuhusu usafiri?

Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.

Kuwa Huru MileleMtazamo wa bei