AIKIDO-2026-10463

TL;DR

Affected versions of this package are vulnerable to an authorization bypass in the moveRequest mutation. When nextRequestID is set to null, the implementation skips validation of the destination collection’s team, allowing a user with EDITOR or OWNER privileges in one team to move requests into collections belonging to another team. This results in cross-team data manipulation and unauthorized modification of resources. The fix adds validation to fetch the destination collection when nextRequestID is null and compares its teamID with the request’s teamID. The operation is rejected if the destination collection does not exist or belongs to a different team, preventing cross-team moves.