mirror of
https://github.com/penpot/penpot.git
synced 2026-08-08 13:58:35 +00:00
Prevent cross-team font injection by checking that when a font-id already has variants, they belong to the same team. This closes a BOLA gap where a user with team edit permissions could create a font variant referencing a font-id from another team. AI-assisted-by: mimo-v2.5-pro