Darko Gjorgjijoski 734ac9421d fix(users): scope user view & update to the acting company ...

User view/update authorized only that the requester owns their active company, not that the target user belonged to it, allowing an owner of one company to read or modify users of another. Require shared company membership in UserPolicy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 23:43:18 +02:00

3.8 KiB

Raw Permalink Blame History

View Raw