OpenAEV has unauthenticated access and missing object-level authorization on player lessons API

{
                    "vendor": "OpenAEV-Platform",
                    "product": "openaev",
                    "versions": [
                        {
                            "version": "< 2.260622.0",
                            "status": "affected"
                        }
                    ]
                }