AIKIDO-2026-977435

TL;DR

The package authorizes nested relation sync and toggle mutations using only the view ability instead of update. A caller with view access to a related record and update access to the parent can fill attributes onto the related model, writing fields without update permission. The nested sync and toggle attributes are also not checked against the resource's update validation rules, so arbitrary values pass unvalidated. The fix requires the update ability for mutations and applies the update validation rules to sync and toggle.