Authenticated users can create sub-processes without the Execution.create permission

[theo-ritense]

A user can still create sub-processes for a case via the REST endpoint regardless of whether the Execution.create permission is given to the user.

The following endpoint is vulnerable for this exploit:

• /api/v1/process-definition/{processDefinitionId}/start-form?documentId={documentId}

Affected versions: Tested on next-minor (12.3.0), but presumably from > 11.0.0 onwards where PBAC was introduced.

Reproduction path on next-minor (local app/gzac instance):

• Login as user

• create a case for leningen with an amount < 20000

• Validate that you can create the sub-process Lening aanvragen with an adjusted name

• On a new incognito window, login as admin

• Remove all existing user-role permissions for the Execution resource

• Go back to the window with the user session without refreshing or navigating

• Validate that you can still create the sub-process Lening aanvragen with an adjusted name

• Refresh the page, and validate that the button is now disabled, which means this permission is only validated in the frontend.