CVE-2026-77768

This vulnerability exposes a design pattern failure that has recurred across multiple frameworks for two decades: authorization middleware that enforces access conditionally based on input shape rather than on what the procedure actually returns. The enforceAccess hook checked for projectId or organizationId keys in the input object, so a procedure receiving only a standalone reportId bypassed the check entirely — not because the developer forgot authorization, but because the middleware's contract was implicit. It enforced membership only when certain keys existed, placing the burden of correct authorization on developer memory rather than on a design where omission is structurally impossible. The adjacent procedure inconsistency is the most telling detail. The update, delete, and duplicate operations in the same file resolved the report first and then checked access against its projectId — the correct pattern. The get procedure did not. This wasn't a knowledge gap across the organization; it was a within-file failure, likely because get operations were treated as low-risk reads and overlooked during the security middleware adoption. Code that predates security infrastructure is the most dangerous code in any mature system — it survives refactors because it already works and nobody remembers it existed before the guardrails. The fix (resolve-then-check) must become a shared abstraction, not developer discipline. Every procedure returning project-scoped data should use a helper that enforces resolution before access checking — making the secure path the only path. Given the accumulating exposure window, where every report created during the vulnerable period adds to the blast radius, treat this as active inventory compromise. Audit procedures written before your authorization middleware was introduced, standardize the resolve-then-check pattern at the framework or shared-module level, and instrument runtime assertions that flag any procedure returning project-scoped entities without passing through a resolution step.

Reviewed through automated stages and approved by a human before publication.