Repository: migration-planner  
Priority: High  
Location: internal/handlers/v1alpha1/source.go:236

Description:  
GET /api/v1/sources/{id}/image-url returns presigned S3 URLs for OVA appliances. Unlike sibling endpoints (GetSource/UpdateSource/DeleteSource), this handler skips the user.Organization == source.OrgID ownership check and proceeds directly to URL generation. Any bearer token plus victim's source UUID yields a download link.

Security Impact:  

OVA embeds victim's long-lived agent JWT and source configuration

Attacker gains credential to write to victim's source (when combined with f002)

Discloses proxy/network configuration

UUIDv4 entropy is insufficient when UUIDs appear in shared assessments, support tickets, browser history

Fix Suggestion:  
Fetch the source first, compare user.Username/user.Organization against source.Username/source.OrgID, and return 404 on mismatch (not 403 to avoid existence oracle). Long-term: wrap SourceService in an Authz decorator. See patches/f003.patch.