API Platform 3 evaluates authorization per operation, not per resource [13]. The `security:` key holds a Symfony expression language string that the framework runs before the operation executes, and if the key is absent the only check left is whatever the firewall did on the way in [13]. CoopCycle runs Symfony 6 with API Platform 3 [12], and its `api_platform.yaml` sets no global default [14], so an omitted key produced silence rather than an error.
The other half of the mechanism is where the operation was written down. The path `/stores/{id}/addresses` is declared in two entity files [20]. The write is on `Store`, gated by `security: "is_granted('edit', object)"` [3]. The read is a second `#[ApiResource]` block on `Address`, whose `uriTemplate` is that same path and whose `uriVariables` link `id` back to `Store::addresses` [17]. Open `src/Entity/Store.php` in v5.5.0 and the coverage looks complete: the `time_slots` and `payment_methods` reads both require dispatcher, courier or `edit` on the object [15], and every one of those expressions resolves through `StoreVoter` and `$user->ownsStore()` [16]. The operation that mattered is not in that file. That is the transferable lesson: the reviewable unit is the operation, and the operations serving one URL are not obliged to share a class.
The provider does its own filtering. `getDropoffAddresses()` joins `Task` and `Delivery`, sets `:store` from the path id and constrains `t.type = 'DROPOFF'` [18]. Because the query is hand-rolled it also steps around Doctrine ownership extensions [19], which is the second layer that would otherwise have noticed a query with no idea who was asking. The reporter files the pair as CWE-862 and CWE-639 [7], missing authorization plus a user-controlled key, which is exactly the two halves.
The 6.5 is Santosh Kumar Puppala's own score, with no vendor rating and no advisory behind it [8][10]. Two things have to hold for it to land the same way on a given deployment. `PR:L` needs an authenticated account, and CoopCycle's self-registration is open, so that privilege costs an attacker a form submission [5]. `C:H` is the load-bearing metric in that vector [8], and what it rests on is tenant density: CoopCycle is licensed as a shared codebase to worker-owned businesses and models `Store` as a first-class tenant because that is how instances are actually used [11]. A single co-op on its own instance leaks its own address book to its own logged-in users, which is a smaller claim. The records themselves are not company data either way; they are customer homes accumulated across every delivery a store has made [21].
If I owned this codebase I would make the framework fail closed, since the absence of a global default is the thing that turns one forgotten key into a live read [13][14]. And I would audit from the generated route list rather than the entity files, because the route list is the only artefact that sees both declarations of `/stores/{id}/addresses` at once [20].
