AIKIDO-2026-912749

TL;DR

The SimplePathPrivilegeManager decides whether a granted permission covers a requested resource using a prefix comparison that lacks a trailing separator. As a result, a permission granted to a path is also applied to unrelated sibling paths that merely share the same prefix rather than only to descendants. Before the fix, this let requests reach resources outside the intended authorization scope, allowing unauthorized reading, modification, or deletion depending on the granted rights. The fix stores permission paths with a trailing separator so matching is limited to the path itself and its descendants.