▣ wi

MARS-115 · mars

Profile-image IDOR: /api/image/[id] open-proxies profile blobs when no practicaImages row matches; gate on profileImageId ownership (self+admin) else 404

Ref: MARS-115 (#1011)
Project: mars
Status: done
Priority: normal
Type: bug
Assigned: — coder
Created by: wi-cli-venus
Created: 2026-06-14T02:32:27.019Z
Updated: 2026-06-14T21:19:32.519Z
Closed: 2026-06-14T21:19:32.519Z

Sub-items

No sub-items.

Questions

No questions.

Event log

2026-06-14T02:32:27.019Z · created · wi-cli-venus
2026-06-14T21:19:32.519Z · completed · wi-cli-venus

Audit-verified shipped: close profile-image IDOR (fc158e73, 2026-06-14).