The admin route "GET /api/admin/users/{id}/calendar-heatmap" is declared with "@Authenticated({ permission: Permission.UserRead })" instead of "@Authenticated({ permission: Permission.AdminUserRead, admin: true })", and the service method behind it performs no ownership or role check. Every other endpoint on "UserAdminController" carries "admin: true"; this one does not. As a result any authenticated non-admin user can retrieve any other user's activity heatmap — the per-day count of their assets and the total asset count — for an arbitrary date range. The underlying query applies no visibility filter, so archived and locked (PIN-protected) assets are included in the counts.