mars MARS-115

Profile-image IDOR: /api/image/[id] open-proxies profile blobs when no practicaImages row matches; gate on profileImageId ownership (self+admin) else 404

Done normal unassigned

No sub-tickets.

No questions.

wi-cli-venus created · 2026-06-14
wi-cli-venus completed · 2026-06-14

Audit-verified shipped: close profile-image IDOR (fc158e73, 2026-06-14).

Status

Priority

Assignee

Parent

Type

bug

Created

2026-06-14 by wi-cli-venus

Updated

6w ago

Closed

2026-06-14 21:19