An authorization bypass exists in the 'POST /api/v2/resources/export' endpoint. Authenticated users can disclose TooljetDB table schemas across workspace boundaries or export app definitions by bypassing granular permission gates. This is achieved by providing a specific `organization id` parameter in the request body to access schemas from other workspaces or to export restricted app definitions within their own workspace.