---
id: multi-user/cross-user-writes-in-the-notify-sidecar
title: "Cross-user writes in the notify sidecar"
theme: multi-user
status: done
created: 2026-08-07
date_source: stated
order: 19
---

**Cross-user writes in the notify sidecar** (fixed 2026-08-07, this session).
`DELETE /_officer/devices/:token` deleted by token with no user predicate, so any account with the
`notify` permission could deregister another's device; and `POST /_officer/notify` let a request
body's `userId` override the proxy-injected `X-Officer-User`, so the same account could push to
another's devices. `deletePushDevice` now takes an optional `userId` (the route passes it, the
APNs/FCM dead-token paths deliberately do not) and the header now wins over the body.