18989 SEC Enforce permission checks on Quick Setup endpoints

This Werk enforces permission checking on the Quick Setup endpoints. Before this Werk,
it was possible for an user without the required permissions to perform actions using
Quick Setup. Now the following endpoints will return a Status 401 (Unauthorized) in such
cases:

/objects/quick_setup/{quick_setup_id}
/objects/quick_setup/{quick_setup_id}/actions/edit/invoke
/objects/quick_setup/{quick_setup_id}/actions/run-action/invoke
/objects/quick_setup/{quick_setup_id}/actions/run-stage-action/invoke
/objects/quick_setup_stage_action_result/{job_id}
/objects/quick_setup/{quick_setup_id}/quick_setup_stage/{stage_index}

The Quick Setup endpoints are internal and not intended for direct usage.

CVE: CVE-2026-24096
CVSS Score: 5.3
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CMK-29960

Change-Id: I5f9f09808bb0a74180019bc7e4593212b0328089

Author: lpetrora

.werks/18989.md

@@ -0,0 +1,29 @@
+[//]: # (werk v2)
+# Enforce permission checks on Quick Setup endpoints
+
+key        | value
+---------- | ---
+date       | 2026-03-16T07:17:07.953024+00:00
+version    | 2.4.0p25
+class      | security
+edition    | cre
+component  | rest-api
+level      | 1
+compatible | yes
+
+Quick Setup endpoints now enforce permission checks, returning a 401 Unauthorized status to users who lack the required permissions. This prevents unauthorized users from performing actions via Quick Setup, enhancing the security of configuration changes.
+
+The following endpoints are affected and will return 401 Unauthorized when accessed without proper permissions:
+
+/objects/quick_setup/{quick_setup_id}
+/objects/quick_setup/{quick_setup_id}/actions/edit/invoke
+/objects/quick_setup/{quick_setup_id}/actions/run-action/invoke
+/objects/quick_setup/{quick_setup_id}/actions/run-stage-action/invoke
+/objects/quick_setup_stage_action_result/{job_id}
+/objects/quick_setup/{quick_setup_id}/quick_setup_stage/{stage_index}
+
+These Quick Setup endpoints are internal and not intended for direct use.
+
+CVE: CVE-2026-24096
+CVSS Score: 5.3
+CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N