Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)

ImpactAegra deployments running 0.9.0 through 0.9.6 with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated user User A, given another user's threadid User B, can:- Execute graph runs against User B's thread via POST /threads/threadid/runs,...