Not able to retrieve badge from the API without ACCESS_MANAGEMENT permission

[nvkhoa666]

Current Behavior

With the default "Badge Viewers" team in Dependency Track, the API to retrieve a project's vulnerabilities badge (/v1/badge/vulns/project/:project/:version) returns 403. If the permission ACCESS_MANAGEMENT is added to that team, then it will work as expected.

Steps to Reproduce

1. Use the API Key from the default "Badge Viewers" to query the API /v1/badge/vulns/project/:project/:version
2. Server returns 403
3. Add the permission ACCESS_MANAGEMENT to the "Badge Viewers" team
4. Use the API Key from the default "Badge Viewers" to query the API /v1/badge/vulns/project/:project/:version
5. Server returns 200

Expected Behavior

API requests to retrieve badges should work with only VIEW_BADGE permission

Dependency-Track Version

4.12.2

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported