Yalguun Tumenkhuu

Incorrect authorization in the Network component allows a remote attacker to bypass the web origin policy through the use of a crafted Chrome extension, provided the attacker can leverage social engineering.

The 'partitioned dag runs' endpoints in the UI enforce only asset-level access control instead of per-Dag authorization. This allows an authenticated UI or API user with global `Asset:read` permission to enumerate the partition run state, schedule configuration, and asset wiring for Dags they are not authorized to read. This issue impacts deployments that use per-Dag read scoping while granting users broader Asset access.