In multi-organization deployments, a console not in self-hosted mode attaches the server's internal key to requests containing an Authorization header before validating the bearer. Certain service-only routes trust this key and extract the organization identity directly from the URL. This allows a remote, unauthenticated caller to use a fabricated bearer to rewrite another organization's provider connection to an attacker-controlled endpoint. Consequently, subsequent prompts may be disclosed, and attacker-controlled responses can influence tasks. The affected API endpoints include 'PUT /v1/orgs/{org}/connections/{name}', 'PUT /v1/orgs/{org}/policy/{backend}', and all routes under '/internal/*'.