403 on vote page when not a committee committer

[dave2wave]

The following was reported by a contributor who went to access the VOTE page for a Project they aren't a committer on:

--Apple-Mail=_9F81B51E-641C-4C39-979D-2EA955518E42
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

I clicked on the link, signed in with my clr login and got=20

You do not have access to this project

An error occurred while processing your request. This has been logged =
and will be addressed.

Status Code: 403


> On Sep 12, 2025, at 10:36, sbp@apache.org wrote:
>=20
> The release candidate page, including downloads, can be found at:
>=20
>  https://release-test.apache.org/vote/tooling/0.25.912+1417

Craig L Russell
clr@apache.org

Two issues.

1. This VOTE page should be open to anyone who has the link from the VOTE thread.
2. Access should not require OAUTH.

Better the proper response than a too quick fix.

[sbp]

We are planning to conduct a review of permissions for all actions available in ATR, which will include a resolution to this issue. One aspect of this is that we may want some pages to give differing levels of information to users depending on their level of permissions.