Problem
The POST /reviews endpoint passes the authenticated user's ID to create_review(), but core/services/review_service.py ignores that argument when creating a review.
The service creates a Review from the supplied profile_id without checking that the profile belongs to the current user. This is inconsistent with get_review() and list_reviews(), which already scope review reads through Profile.user_id.
Impact
An authenticated user who knows another user's profile UUID may be able to create a review for that profile by sending:
POST /reviews
{"profile_id": "<another-users-profile-id>"}
Problem
The
POST /reviewsendpoint passes the authenticated user's ID tocreate_review(), butcore/services/review_service.pyignores that argument when creating a review.The service creates a
Reviewfrom the suppliedprofile_idwithout checking that the profile belongs to the current user. This is inconsistent withget_review()andlist_reviews(), which already scope review reads throughProfile.user_id.Impact
An authenticated user who knows another user's profile UUID may be able to create a review for that profile by sending: