Impact

1. Primary impact - self-approval: The approver checks (approver-group membership, change permission on the object under review, one-response-per-user) are enforced only in the approve/deny actions on ApprovalWorkflowStage. The generic ApprovalWorkflowStageResponse create endpoint enforces none of them, so a user holding only extras.add approvalworkflowstageresponse can POST approved responses directly and drive a stage past its min approvers threshold with no legitimate approver involved. The serializer also exposes user and state as writable, letting the attacker attribute responses to arbitrary users.
2. Escalated impact job activation: Because the approval workflow gates a ScheduledJob, self-approval does not stop at the approval record. Stage approval cascades through ApprovalWorkflow.save() to on workflow approved(), which sets the target job to enabled/active.

Patches

Workarounds