From 081e578a5700115be8dc0464c0ddac5ee740aa82 Mon Sep 17 00:00:00 2001
From: Muhsin <12408980+muhsin-k@users.noreply.github.com>
Date: Fri, 17 Apr 2026 23:38:40 +0400
Subject: [PATCH] fix(voice): validate conversation_id when resolving Call in
 ConferenceController

Require the resolved Call to belong to the passed conversation_id so a
request with mismatched (conversation_id, call_sid) fails instead of
silently operating on the call from call_sid. Restores the implicit
authorization the previous conversation-based lookup provided.
---
 .../app/controllers/api/v1/accounts/conference_controller.rb  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/enterprise/app/controllers/api/v1/accounts/conference_controller.rb b/enterprise/app/controllers/api/v1/accounts/conference_controller.rb
index 3361beac2..07cec861d 100644
--- a/enterprise/app/controllers/api/v1/accounts/conference_controller.rb
+++ b/enterprise/app/controllers/api/v1/accounts/conference_controller.rb
@@ -36,7 +36,9 @@ class Api::V1::Accounts::ConferenceController < Api::V1::Accounts::BaseControlle
     sid = params[:call_sid].presence
     raise ActionController::ParameterMissing, :call_sid if sid.blank?
 
-    Call.where(inbox_id: @voice_inbox.id, provider: :twilio).find_by!(provider_call_id: sid)
+    conversation = fetch_conversation_by_display_id
+    Call.where(inbox_id: @voice_inbox.id, provider: :twilio, conversation_id: conversation.id)
+        .find_by!(provider_call_id: sid)
   end
 
   def set_voice_inbox_for_conference