Home Assistant closes a route that let a non-administrator open the interface of an administrator-only app. The app proxy checked the session cookie but did not enforce the app’s administrator restriction.
Stefan Agner makes Supervisor check the person’s role before opening a restricted app. Ordinary household accounts retain access to apps that explicitly allow them. The correction uses identity information Core already supplies, so it does not require a matching Core upgrade.
Changing an administrator’s role does not immediately revoke every running session: the cached role is refreshed when that person creates a new session or Supervisor restarts, and access also ends when the session expires.