AIKIDO-2026-83521

TL;DR

The Admin API AssetService.update and StockLocationService.update methods fetch a channel-aware entity by its raw id without scoping the lookup to the caller's active channel, unlike every sibling read, update, and delete path. A channel-restricted administrator can modify assets and stock locations belonging to other channels by supplying the target entity's sequential id. The write commits even though a trailing channel-scoped read fails, producing a blind cross-channel write that breaks tenant isolation. The fix passes the active channel id to both lookups so entities belonging only to another channel are rejected.