AIKIDO-2026-344433

TL;DR

Under Fine-Grained Admin Permissions v2, the client scope assignment endpoints only check manage permission on the client and never check the separate client-scope permission. A delegated admin can attach or detach client scopes they are not authorized to manage or view, which can inject unauthorized claims into tokens issued to end users. The fix enforces client-scope permissions on those assignment endpoints.