AIKIDO-2026-823759

TL;DR

Several service classes override the base item mutation methods to perform cleanup such as nulling foreign keys or clearing caches before delegating to the superclass, where the caller's permission check runs. The side effects were therefore applied before authorization and persisted even when the request was subsequently rejected with a permission error. An unauthenticated caller who knows a flow, user, or share identifier could permanently disconnect a flow's operation chain, strip authorship metadata from other users' rows, or repeatedly flush the permissions cache. The fix evaluates access before performing any side effect or defers it until after the authorized mutation succeeds.