Portfolio access control not respected in API requests?

[thomashucke]

Current Behavior

New projects / versions are created in root though project access should be limited by porfolio access control policy to one existing (parent) project.

Steps to Reproduce

1. Create a new project "Parent project"
2. Set up a team "Gitlab-CI publish only" with minimal permissions to upload SBOMs and create new projects (BOM_UPLOAD, PROJECT_CREATION_UPLOAD)
3. Enable portfolio access control
4. For team "Gitlab-CI publish only" only enable project access only to "Parent project"
5. POST a new SBOM using CURL without parameter "parentName" or "parentUUID"

Expected Behavior

POST should fail because of the access limitation by porfolio access control policy

Dependency-Track Version

4.12.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Mozilla Firefox

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported