Multiple core controllers and model capture paths accept client-controlled request fields, including primary keys (`id`) and ownership or scope foreign keys such as `event id`, `org id`, `user id`, `sharing group id`, `galaxy cluster uuid`, `organisation uuid`, and related nested object identifiers, without consistent stripping, pinning, or revalidation against server-authorized objects. An authenticated user with access to one authorized object can submit crafted REST or form payloads to save data against a different object than the one verified by authorization logic. This can lead to object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event or object injection, proposal retargeting, or stored attacker-controlled content appearing in another user's context. The issue stems from the `CRUDComponent::edit()` function copying supplied fields, including a payload primary key, onto the loaded record, which allows the CakePHP `save()` function to update an arbitrary row if the loaded ID is not re-pinned.