AIKIDO-2026-569155

TL;DR

The project view reporting export route places its authorization attributes on the report method instead of the controller class, so the export route inherits no permission check. Any authenticated user, including a plain role without project_reporting, can call the export and download the same project overview dataset that the report itself returns 403 for. The exposed data spans customer names, project names, currency, budget type, and aggregate totals across all customers. The fix moves the permission checks to the controller class so the report and its export share the same guards.