Incorrect Authorization leads to see other users Documents Uploaded

How it was found

Summary:

Hi team, when user upload document, other user can see this docs only with link

Steps To Reproduce:

1. loign to portal with user A : https://qcn.mytva.com

2. go to admin section and upload a document. {F2782891}

3. click on link to see uploaded image. like

{F2782892}

4. login to portal with user B
5. go to above url, we can see and download user A document.

{F2782896}

Impact

any login user can see other user documents