CVE-2026-54361

@@ -98,6 +98,18 @@ public function edit($id)
                 }
             }
             $params = [
+                // Identity and ownership fields must never be reassigned through edit. The model only
+                // forces these on create (Collection::beforeValidate runs its ownership block only when
+                // the id is empty), and CRUDComponent::edit() copies every supplied field onto the loaded
+                // record. Without pinning them here a user could hand the collection to another org/user,
+                // or redirect the save onto a different collection via an injected id (mayModify only
+                // checked the id from the route). Force them back to the stored values.
+                'override' => [
+                    'id' => $oldCollection['Collection']['id'],
+                    'orgc_id' => $oldCollection['Collection']['orgc_id'],
+                    'org_id' => $oldCollection['Collection']['org_id'],
+                    'user_id' => $oldCollection['Collection']['user_id'],
+                ],
                 'afterSave' => function (array &$collection) use ($data) {
                     $collection = $this->Collection->CollectionElement->captureElements($collection);
                     return $collection;

@@ -63,6 +63,11 @@ public function delegateEvent($id)
             $this->request->data['EventDelegation']['requester_org_id'] = $this->Auth->user('org_id');
             $org_id = $this->Toolbox->findIdByUuid($this->EventDelegation->Event->Org, $this->request->data['EventDelegation']['org_id']);
             $this->request->data['EventDelegation']['org_id'] = $org_id;
+            // Never allow an id to be supplied here: a primary key in the save data turns
+            // create() + save() into an update of an arbitrary existing delegation. The auth
+            // checks above only cover the event in the URL, so an injected id would let a user
+            // overwrite a delegation request belonging to another event/org.
+            unset($this->request->data['EventDelegation']['id']);
             $this->EventDelegation->create();
             $result = $this->EventDelegation->save($this->request->data['EventDelegation']);
             $org = $this->EventDelegation->Event->Org->find('first', array(

@@ -606,6 +606,11 @@ public function edit($id = null)
             }
             $this->request->data['ShadowAttribute']['org_id'] =  $this->Auth->user('org_id');
             $this->request->data['ShadowAttribute']['email'] = $this->Auth->user('email');
+            // The $id route param identifies the *attribute* being proposed against, not the proposal.
+            // A ShadowAttribute id in the request data would turn this save into an update of an
+            // arbitrary existing proposal (belonging to another org), so strip it: edit() only ever
+            // creates a new proposal. Mirrors the same guard in add().
+            unset($this->request->data['ShadowAttribute']['id']);
             if ($this->ShadowAttribute->save($this->request->data)) {
                 $emailResult = "";
                 if (!isset($this->request->data['ShadowAttribute']['deleted']) || !$this->request->data['ShadowAttribute']['deleted']) {

@@ -168,6 +168,11 @@ public function edit($id)
             'beforeSave' => function (array $data) use ($tagCollection) {
                 $data['TagCollection']['id'] = $tagCollection['TagCollection']['id'];
                 $data['TagCollection']['uuid'] = $tagCollection['TagCollection']['uuid'];
+                // Ownership must never be reassigned through edit: it is only set on create, and
+                // CRUDComponent::edit() copies every supplied field, so pin org_id/user_id back to
+                // the stored values to prevent transferring the collection to another org/user.
+                $data['TagCollection']['org_id'] = $tagCollection['TagCollection']['org_id'];
+                $data['TagCollection']['user_id'] = $tagCollection['TagCollection']['user_id'];
                 return $data;
             }
         ];
@@ -201,6 +206,10 @@ public function editWithTags($id)
 
             $data['TagCollection']['id'] = $id;
             $data['TagCollection']['uuid'] = $tagCollection['TagCollection']['uuid'];
+            // Ownership must never be reassigned through edit; pin org_id/user_id back to the stored
+            // values so a supplied org_id/user_id cannot transfer the collection to another org/user.
+            $data['TagCollection']['org_id'] = $tagCollection['TagCollection']['org_id'];
+            $data['TagCollection']['user_id'] = $tagCollection['TagCollection']['user_id'];
 
             if (isset($data['TagCollection']['tags'])) {
                 $data['TagCollectionTag'] = [];