Paul Lorenz eba2afbe06 Prevent enrollment-based privilege escalation to admin identities. Fixes #4049 ...

- denies non-admins the ability to create, read, refresh, or delete an
  enrollment belonging to an admin identity, since an enrollment carries
  the one-time-token/JWT used to enroll as its target identity
- filters admin-identity enrollments out of enrollment lists for non-admin
  callers
- denies access when the target identity or enrollment cannot be loaded
  rather than relying on a downstream handler
- adds a permissions test covering each escalation path plus the
  admin-allowed behavior

Backport to release-v2.0.x of #4013.

2026-06-26 13:18:33 -04:00

..

policy

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

routes

Prevent enrollment-based privilege escalation to admin identities. Fixes #4049

2026-06-26 13:18:33 -04:00