Missing ownership check for bulk actions