Dmitrymaranik

An incorrect authorization flaw exists in the User Service API. The system verifies the `user.read` permission against the caller's organization instead of the organization that owns the target user. An authenticated member with org-scoped `user.read` permissions can use the 'GET /v2/users/{userId}/authentication methods' endpoint to identify the authentication method types registered by users in other organizations.

Cluster-scoped APIs do not consistently validate per-cluster access. This allows an authenticated user with cluster management permissions to operate on clusters outside their granted scope. Because the affected endpoints process cluster-specific data without confirming the requesting user's authorization for that specific cluster, a user with management rights over one cluster may read or modify data in other clusters under certain role and cluster configurations.