PT-2026-55584

Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installation id to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App...