Lots of apps let people answer a comment notification by replying to the email. The inbound handler parses the reply, finds the thread from a token in the Reply-To address, and posts the text as that user. The token was minted when the notification went out, so it often ends up treated as permission.
Say a vendor gets removed from a project on Tuesday. On Thursday they reply to last week's notification email. The handler matches the token to the thread and to the vendor's account, and the comment lands on a project they can no longer open.
Use the token only to find the thread and the user, then run the same comment check your web UI runs, against current permissions. If it fails, drop the message and send a short bounce saying the reply wasn't posted. Expiring tokens helps too, but expiry alone still leaves a window of days.
Quick test: get a notification email as user B, remove B's access to the record, then reply to that email. If the reply shows up on the record, the inbound handler skipped the check.
Top comments (0)