PT-2026-41504

Summary 12 endpoints in ConfigurationTabController.php use userIsAuthenticated login-only check instead of userHasPermissionPermissionType::CONFIGURATION EDIT. This allows any authenticated user — including ones with zero admin permissions — to enumerate system configuration metadata including th...