Webform interaction entry path does not enforce the dispatcher authorization: bearer-token resume and unauthenticated task-handle bind

A release-candidate audit of the changes since 1.0.0-alpha8 found that the Webform interaction entry path (the OrchestraInteractionHandler resume and bind) does not enforce the authorization the interaction dispatcher (InteractionController) enforces. Two gaps:

Bearer-token resume skips the dispatcher checks

The dispatcher requires that the parked node declares an interaction, that the outcome is one the node offers, and (for an identity-gated task) that the acting user is allowed. The webform resume path calls CapabilityGateway::resume(), which goes straight to WorkflowEngine::resumeWithResult() with none of those checks. An instance-scoped bearer handle therefore resumes whatever token is parked on the instance, including an identity-gated operator task, with the handler's configured result. Instance-scoped bearer handles are minted into the party's own URL on start when "Return to the workflow" is enabled. Effect: a party's self-service handle can complete an operator's step.

Unauthenticated task-handle bind

TaskContinuationResolver::resolve() accepts an orchestra-task:{id} handle for any loadable token id, with no authorization and no expiry check: it relies on the resumer's identity check, which guards only the resume, not the bind. The handler's preSave then binds the submission to that token's instance unconditionally. So an anonymous visitor can submit a public handler-equipped form carrying such a handle and write their submission as a source entity of any instance; that submission can then surface to the legitimate operator on the next review step. The resume itself correctly fails for the attacker, so no run is driven, but attacker-controlled content is injected into another instance's review surface.

Direction

• Route the webform resume through the same authorization the dispatcher applies: the parked node must declare an interaction, the outcome must be offered by the node, and an identity-gated task must check the acting user.
• Make the bind require the same authorization as the resume (or defer the bind until the resume authorizes), so a handle that cannot resume cannot bind either.
• Consider scoping "Return to the workflow" handles to the specific token rather than the whole instance, so a self-service handle cannot reach an operator step.

Severity and disclosure

Exploitability depends on deployment configuration (instance-scoped return links coexisting with a public handler-equipped form and operator tasks on the same instance). Orchestra is at alpha and is not covered by the security advisory policy, so this is filed publicly.