From a7ee8766b38091e8fc2aaa64cc3b3c6ba40fd8e2 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Tue, 22 Sep 2026 08:13:58 +0200
Subject: [PATCH] Validate ownership of asset profile

---
 .../src/app/activities/activities.service.ts   | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/apps/api/src/app/activities/activities.service.ts b/apps/api/src/app/activities/activities.service.ts
index ecc2296a90..0eb310ce49 100644
--- a/apps/api/src/app/activities/activities.service.ts
+++ b/apps/api/src/app/activities/activities.service.ts
@@ -901,6 +901,24 @@ export class ActivitiesService {
     ) {
       delete data.SymbolProfile.connect;
       delete data.SymbolProfile.update.name;
+
+      const { SymbolProfile: assetProfile } =
+        await this.prismaService.order.findUniqueOrThrow({
+          where,
+          select: {
+            SymbolProfile: {
+              select: {
+                userId: true
+              }
+            }
+          }
+        });
+
+      const isOwnAssetProfile = assetProfile.userId === userId;
+
+      if (!isOwnAssetProfile) {
+        delete data.SymbolProfile.update;
+      }
     } else {
       delete data.SymbolProfile.update;