A missing authorization issue exists in the `query-dynamic-sub-workflows` API. The API fails to properly verify if an authenticated user has the necessary permissions to access the workflows being queried. Consequently, an authenticated user can invoke the API using parameters that reference workflows from a project they are not authorized to access, leading to unauthorized disclosure of workflow information.