Description
The grade submission endpoint under the parent workflow appears to validate institute ownership but does not consistently enforce role restrictions before creating or modifying academic grade records.
This may allow parent accounts to submit or modify grades for students belonging to the same institute.
Academic grade creation should be restricted to authorized teaching or administrative roles only.
Steps to Reproduce
- Log in using a parent account.
- Navigate to the grade submission endpoint.
- Submit a valid grade payload for a student within the same institute.
- Observe that the grade record is accepted.
Expected Behavior
Only teachers and administrators should be able to create or modify grade records.
Screenshots
N/A (backend authorization issue).
Environment
- OS: Any
- Browser: Any
- Version: Current master branch
Description
The grade submission endpoint under the parent workflow appears to validate institute ownership but does not consistently enforce role restrictions before creating or modifying academic grade records.
This may allow parent accounts to submit or modify grades for students belonging to the same institute.
Academic grade creation should be restricted to authorized teaching or administrative roles only.
Steps to Reproduce
Expected Behavior
Only teachers and administrators should be able to create or modify grade records.
Screenshots
N/A (backend authorization issue).
Environment