Spot the bug in the invoice controller

from Spring Boot
Spring Boot 4.1.1 / Java 25 LTS intermediate 4 min 1 issue to find

Find the authorization flaw in this generated controller.

Java
@RestController
class InvoiceController {
    private final InvoiceRepository invoices;

    @GetMapping("/accounts/{accountId}/invoices/{invoiceId}")
    Invoice invoice(@PathVariable long accountId, @PathVariable long invoiceId) {
        return invoices.findById(invoiceId)
                .orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND));
    }
}
Open in playground
Report an error