Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)

Summary: An account with the Editor role can successfully call the API endpoint `/workspaces/<WORKSPACE_ID>/tool-preferences/ai_gateway/enable`that disables workspace-wide admin-only feature (Lovable AI). The API does not enforce server-side role checks for this action, allowing a vertical …

POST /workspaces/<WORKSPACE_ID>/tool-preferences/ai_gateway/enable HTTP/2
Host: lovable-api.com
Authorization: Bearer <OWNER-TOKEN>
Content-Type: application/json


{"approval_preference":"disable"}