Satisfy-across confused-deputy IDOR + account party self-heal

Shipped

6 ஜூலை, 2026 அன்று 1:41 AM UTC

Author

Kamo

Commit

282105e

- HIGH: satisfy-across gated on the path partyId but fanned out over the DOCUMENT's own party downstream; verify the document belongs to the authorized party (same org) before relaying, else 403 — closes cross-borrower state-mutation + info-leak. - listParties self-heals party links across the account's loans so the tab populates.