`PluginHost.cs:200,217-219` injects the host's primary `SchulyDbContext` (all users/schools/grades, unfiltered) and a raw `IHttpContextAccessor` into every plugin's DI container, rather than a scoped subset of what each plugin actually needs.
This is a broader capability grant than plugins require, independent of the credential-isolation bugs tracked separately. Design change, not a one-line fix — tracking issue.
Fix: narrow what's injected into the plugin container to a minimal, scoped surface per plugin.
Found during the Aug 2026 security sweep.
`PluginHost.cs:200,217-219` injects the host's primary `SchulyDbContext` (all users/schools/grades, unfiltered) and a raw `IHttpContextAccessor` into every plugin's DI container, rather than a scoped subset of what each plugin actually needs.
This is a broader capability grant than plugins require, independent of the credential-isolation bugs tracked separately. Design change, not a one-line fix — tracking issue.
Fix: narrow what's injected into the plugin container to a minimal, scoped surface per plugin.
Found during the Aug 2026 security sweep.