Cross-tenant role modification and deletion via unscoped lookup

Authorization bypass in Daytona before 0.185.0 allows remote authenticated users to modify or delete another organization's roles. The update and delete endpoints authorize ownership of the organization in the request path but resolve the target role solely by identifier without confirming its organization. Exploitation requires ownership of any organization and knowledge of a non-enumerable target role identifier; it enables permission changes, role deletion, and disclosure of the returned permission set.