Unauthorized workflow access via misattributed sharing ownership

Authorization bypass in OpenStack Mistral allows remote authenticated users to read and execute private workflows via the membership API. When an accepted recipient names a third project in a new share, the API defaults the membership row's project_id to that recipient instead of the workflow owner. Exploitation requires an accepted private-workflow share and acceptance by the third project; the owner cannot see or revoke the resulting membership, while the resharing project retains revocation control.