Description
The exception update workflow appears to allow authenticated students to approve or reject exception requests due to missing role enforcement in the update route.
The route validates authentication and institute ownership but does not consistently verify that the requester is a teacher, institute administrator, or platform administrator before processing status updates.
As a result, students belonging to the same institute may be able to modify exception approval states.
Steps to Reproduce
- Log in as a student account.
- Obtain a valid exception request ID belonging to the same institute.
- Send an update request with status set to approved or rejected.
- Observe that the request is processed successfully.
Expected Behavior
Only authorized staff members (teachers, institute admins, or platform admins) should be able to approve or reject exception requests.
Screenshots
N/A (backend authorization issue).
Environment
- OS: Any
- Browser: Any
- Version: Current master branch
Description
The exception update workflow appears to allow authenticated students to approve or reject exception requests due to missing role enforcement in the update route.
The route validates authentication and institute ownership but does not consistently verify that the requester is a teacher, institute administrator, or platform administrator before processing status updates.
As a result, students belonging to the same institute may be able to modify exception approval states.
Steps to Reproduce
Expected Behavior
Only authorized staff members (teachers, institute admins, or platform admins) should be able to approve or reject exception requests.
Screenshots
N/A (backend authorization issue).
Environment