Enforce permission check on subuser list endpoint

services/nginx/app/routes/subusersRoute.php

@@ -504,13 +504,9 @@ class subusersRoute
                 $response->error('Unauthorized', 401);
             }
 
-            // Link route permission to Subusers node so subusers can be constrained by grants.
-            // For classic users we keep current behavior (no extra user permission enforced here).
+            // Link route permission to Subusers node for all authenticated principals.
             $permission_list = self::definePermission('list_own_subusers', subusers_permission_node_key::SUBUSERS_LIST);
-            if ($subuser !== false) {
-                // Only enforce for subuser principals; classic users are governed by existing user ACLs elsewhere.
-                self::requirePermission($permission_list);
-            }
+            self::requirePermission($permission_list);
 
             // Determine effective customer number (user's customer number or subuser's target header)
             if ($user !== false) {
@@ -673,4 +669,4 @@ class subusersRoute
             $response->success(['cvr' => $cvr, 'customer_number' => $results[0]->customerNumber]);
         });
     }
-}
+}