Anyone can edit or delete a harvest source they don't own
Anyone can edit or delete a harvest source they don't own: a task in MiMo-V2.6-RL-oss: Agentic RL Environments (MiMo RL release). I noticed that the harvest source endpoints PUT /api/1/harvest/source/<ident and DELETE /api/1/harvest/source/<ident don't seem to check whether the caller is actually…
The task
I noticed that the harvest source endpoints PUT /api/1/harvest/source/<ident> and DELETE /api/1/harvest/source/<ident> don't seem to check whether the caller is actually allowed to touch the source. To reproduce: log in as a regular user (not admin), pick a harvest source that…
Part of XiaomiMiMo/MiMo-V2.6-RL-oss.