jupiter007 · Sep 1, 2026 · Sep 1, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## DMPTool Releases
 
+### v5.63
+- Fixed vulnerability in contributors controller and research output controller [#802]
+
 ### v5.62
 - Fix bug that was using old invalid env variable to set the mailer domains. Switched to use the AnywayConfig value instead
 - Removed the old host rebinding config from environment files because the ENV variable was always nil

diff --git a/app/controllers/contributors_controller.rb b/app/controllers/contributors_controller.rb
@@ -12,13 +12,13 @@ class ContributorsController < ApplicationController
 
   # GET /plans/:plan_id/contributors
   def index
-    authorize @plan
+    authorize @plan, :show?
     @contributors = @plan.contributors
   end
 
   # GET /plans/:plan_id/contributors/new
   def new
-    authorize @plan
+    authorize @plan, :edit?
     default_org = (@plan.org.presence || current_user.org)
     @contributor = Contributor.new(plan: @plan, org: default_org)
   end

diff --git a/app/controllers/paginable/research_outputs_controller.rb b/app/controllers/paginable/research_outputs_controller.rb
@@ -11,7 +11,7 @@ class ResearchOutputsController < ApplicationController
     # GET /paginable/plans/:plan_id/research_outputs
     def index
       @plan = Plan.find_by(id: params[:plan_id])
-      authorize @plan
+      authorize @plan, :show?
       paginable_renderise(
         partial: 'index',
         scope: ResearchOutput.where(plan_id: @plan.id),