Cross-Workspace IDOR in Parsed Files API allows Unauthorized Deletion

[!NOTE]
Triage Summary

Vulnerability 1 (Cross-Workspace File Embedding) - Dismissed
This is not a valid vulnerability. Managers and admins already have unrestricted access to all workspaces by design (see Workspace.whereWithUser() which bypasses workspace filtering for these roles). The ability to embed a file from Workspace B while calling the API with Workspace A's slug does not constitute privilege escalation—the manager could simply navigate to Workspace B and perform the same action directly.

Vulnerability 2 (Cross-Workspace File Deletion) - Confirmed with amendment
Valid IDOR bug. The delete endpoint uses ROLES.all (any authenticated user) and performs no parsed file ownership check on the provided fileIds. A default-role user with access only to Workspace A can delete parsed files belonging to other users on Workspace A, but not on workspaces they are not already permitted to access by the admin/manager.

Severity is reduced due to:

• Only temporary parsed files are affected, not permanent embedded documents
• No data exfiltration (deletion only, no read access)
• Impact is recoverable (users can re-upload files)
• Requires authenticated session
• Limited to other users within the same workspace or other workspaces they are permitted to access already

Summary

Two IDOR vulnerabilities in the workspace parsed files API allow authenticated users to access and manipulate files across workspace boundaries in mu…