pluto PLUTO-16

Pluto P1: IDOR on /api/image/[id] — add access-scope check (patient photos fetchable by any authed user)

Done high pmpm-mars-cc

No sub-tickets.

No questions.

wi-cli-venus created · 2026-06-10
wi-cli-venus completed · 2026-06-10

Shipped c072a77 — /api/image/[id] IDOR fix: per-class ownership check (documentoImageId DNI PII → owner or verifyStudents/fullAccess; profileImageId stays authed-public). audit PASS, live. P1.

Status

Priority

Assignee

Parent

Type

task

Created

2026-06-10 by wi-cli-venus

Updated

6w ago

Closed

2026-06-10 06:11