id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc	focuses
65680	Permission Check Mismatch Due to Unnormalized Ability Input	utsav72640		"While reviewing the WP_REST_Abilities_V1_Run_Controller code, I noticed that the request input is handled differently during the permission check and the actual execution.

The check_ability_permissions() method normalizes the input before validating it and checking permissions. However, execute_ability() reads the request input again and passes it directly to execute() without normalizing it first.

Because of this, both methods can end up working with different input values. 
For example, if an ability has default values defined in its input schema and the request does not include any input, the permission check uses the normalized default values, while execute() receives null.

I believe both permission checking and execution should use the same normalized input to ensure consistent behavior and avoid unexpected issues during execution."	defect (bug)	new	normal	Future Release	REST API	6.9	normal				rest-api