GHSA-pfvx-m77f-6qr6

The tRPC mutations github.update, gitlab.update, bitbucket.update and gitea.update are gated only by the RBAC check withPermission("gitProviders","create") and omit the per-resource organization-ownership assertion (assertGitProviderAccess) that every sibling procedure in the same routers enforces. They call updateGitProvider(input.gitProviderId, { organizationId: ctx.session.activeOrganizationId }), whose SQL is UPDATE gitProvider SET ... WHERE gitProviderId = $id with no organization constraint. An authenticated user who is owner/admin of their own organization can therefore pass another organization's gitProviderId/githubId and REASSIGN that victim git provider into the attacker's organization (and overwrite its fields).