Missing authorization check in /organizations/{org_id}/collections/details allows Manager-role users to enumerate all collections

Summary

The get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) in src/api/core/organizations.rs is missing the has_full_access() authorization check that exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve the names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization.

Affected Component

• File: src/api/core/organizations.rs
• Function: get_org_collections_details (line ~380)
• CWE: CWE-862 (Missing Authorization)

Details

get_org_collections correctly gates access:

if !headers.membership.has_full_access() {
    err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
}

get_org_collections_details omits this check and instead only requires ManagerHeadersLoose (any Manager/Admin/Owner). It then calls Collection::find_by_organization(), returning all collections unconditionally. The per-collection assigned boolean is computed but not used to filter the response.

Impact

A Manager with restricted collection access can:

• Enumerate all collection names (potentially revealing sensitive organizational structure, e.g. "Executive Passwords", "Financial Systems")
• Discover which users have access to which collections
• Map group-to-collection assignments

This violates the principle of least privilege and can be used for reconnaissance prior to further attacks.

Remediation

Add the has_full_access() check to get_org_collections_details, or filter the returned collections to only those the Manager is assigned to — consistent with how get_org_collections behaves.