Changelog

Transfer protection authorization tightened (PR #768)

Release Notes

Summary

Transfer protection actions (password protect, remove protection, and organization lock) now require the caller to belong to the transfer's tenant and, where applicable, be the transfer sender.

Changes

  • Protect, unprotect, and organization-lock transfer actions now verify tenant membership before any other authorization checks.
  • Only the transfer sender may modify protection settings on their transfers.
  • Cross-tenant transfer mutation requests are rejected with an access denied response and do not create records in the target tenant.
  • Unknown transfer IDs return a not-found response instead of an internal error.

Impact

Security/audit impact: Unauthorized users can no longer attempt transfer protection changes against transfers outside their organization. Tenant isolation for transfer mutations is enforced earlier in the request path.

Classification

Auth, Security, API, Bug Fix

Note that no exploit was possible due to tenant isolations.

Source: cursor-automation | PR #768: fix: enforce tenant authorization for transfer mutations | https://github.com/EpykLab/stllr/pull/768