From 99bf6a9d91c70731e503bf17b22f0c2cd90879d9 Mon Sep 17 00:00:00 2001
From: grnd-alt <git@belakkaf.net>
Date: Mon, 9 Mar 2026 15:55:02 +0100
Subject: [PATCH] fix: check cardId for attachment

Signed-off-by: grnd-alt <git@belakkaf.net>
---
 lib/Service/AttachmentService.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/Service/AttachmentService.php b/lib/Service/AttachmentService.php
index e284ed666f..06f0328e1c 100644
--- a/lib/Service/AttachmentService.php
+++ b/lib/Service/AttachmentService.php
@@ -273,6 +273,7 @@ public function update($cardId, $attachmentId, $data, $type = 'deck_file') {
 		}
 
 		if ($service instanceof ICustomAttachmentService) {
+			$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
 			try {
 				$attachment = new Attachment();
 				$attachment->setId($attachmentId);