No restriction on who can add task progress update

Issue Description

[Provide a brief description of the issue here.]

Expected Behavior

[Describe what should happen when this issue is resolved.]

Current Behavior

[Explain what currently happens when this issue is encountered.]

Screenshots

[If applicable, add screenshots or images that help illustrate the issue. You can use the following Markdown syntax to embed images:]

Reproducibility

• This issue is reproducible
• This issue is not reproducible

Steps to Reproduce

1. [Step 1]
2. [Step 2]

Severity/Priority

• Critical
• High
• Medium
• Low

Additional Information

[Include any additional context, logs, or details that might be helpful in addressing the issue.]

Checklist

• I have read and followed the project's code of conduct.
• I have searched for similar issues before creating this one.
• I have provided all the necessary information to understand and reproduce the issue.
• I am willing to contribute to the resolution of this issue.

Thank you for contributing to our project! We appreciate your help in improving it.

The issue names no files, endpoint, actor permissions, or reproduction steps. Start by locating the API entry point for adding task progress updates and inspect its existing authorization checks; done means unauthorized users can no longer add progress updates, with coverage for the permitted and denied cases.