Broken Access Control – Billing Manager Can Access Owner-Only Organization Endpoint

Summary:#

A user with the Billing Manager role can directly access an Owner-only organization endpoint related to Customer Profiles by manually visiting the endpoint URL /account/trust-hub/customer-profiles. The application relies on frontend restrictions only, while the backend does not enforce proper role-based authorization.

Steps To Reproduce:#

1. Login as an Owner.
2. Navigate to: /account/trust-hub/customer-profiles → Access is granted as expected.
3. Login as a Billing Manager.
4. Directly visit the same endpoint URL.
5. Observe that access is granted, despite the role lacking permission.

Imapct:#

Unauthorized access to organization-level customer profile data Violation of role-based access control Potential abuse of sensitive organization configuration or trust-related information