AIKIDO-2026-10394

TL;DR

Affected versions of this package are vulnerable to an improper access control issue in the relationship endpoint. The implementation does not sufficiently enforce authorization checks when retrieving related resources, allowing authenticated users to access data beyond their intended permissions. An attacker could exploit this by querying the endpoint to retrieve restricted or non-public content. The issue is addressed by adding proper authorization validation to ensure that only permitted resources are returned.