How to use GitHub
- Please use the 👍 reaction to show that you are affected by the same issue.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Describe the bug
The API endpoint responsible for transferring board ownership allows a user to specify a new owner via the newOwner parameter. However, the backend service does not validate whether the specified user actually exists in the system.
To Reproduce
Steps to reproduce the behavior:
- Create a new Deck board.
- Transfer ownership with
/apps/deck/boards/26/transferOwner using wrong new owner.
- The requests is successful
Expected behavior
It returns an error Invalid request