CVE-2026-59979

YosemiteCrew suffers from an Insecure Direct Object Reference (IDOR) and authorization bypass vulnerability in its service and PMS task-library/template routes. The authorizeCognito middleware in apps/backend/src/middlewares/auth.ts fails to perform withOrgPermissions() and requirePermission(...)...