Server Action writes without an auth check
Why it matters
Every exported Server Action is a public POST endpoint that anyone can call with any arguments; the page that renders the form is not a guard.
Fix
Check the session/user (and that they own the record) at the top of the action, before the write.
Credit
From the Next.js team
Treat Server Actions like public API endpoints: authenticate and authorize inside each action.
From OWASP
Broken access control is the top web application risk; authorization must be enforced server-side on every request.