CVE-2024-55186: Oqtane Framework Insecure Direct Object Reference vulnerability

The vulnerability stems from insufficient authorization checks in notification handling. The NotificationController's methods (Put/Delete) relied on the flawed IsAuthorized method which defaulted to granting access. The GitHub diff shows the authorization logic was corrected by: 1) Adding FromUserId checks in Put, 2) Changing IsAuthorized default from true to false, and 3) Adding ownership validation. The client-side View.razor component complements this vulnerability by providing the attack surface for IDOR exploitation through notification ID manipulation.