idor

The endpoint guarded the target entity but never the source media ids. After a rebind, managing someone else's media became legitimate.

TL;DR: An editor rebinds another bidang's media into their own gallery because the endpoint guarded only the target, not the source. The fix resolves media modules in one parameterized batched query and rejects out-of-scope ids with a static 403 before any write. A similar unguarded path in announcements shows source objects need the same object-level checks on every write path.