mosaicstack/stack
16
0
Fork 1
Code Issues 335 Pull Requests 15 Actions Packages Projects Releases 15 Wiki Activity

gateway: /api/teams endpoints unscoped — any authenticated user can enumerate all teams and member records #1428

New Issue
Closed
opened 2026-08-26 22:15:57 +00:00 by fred · 0 comments
fred commented 2026-08-26 22:15:57 +00:00
Collaborator
Copy Link
Copy Source

Found by the webUI audit (lane webui-audit, A3 finding F9.2; severity upgraded to MAJOR in P2 cross-review).

Measured: every route in apps/gateway/src/workspace/teams.controller.ts is behind AuthGuard only, with no membership scoping: GET /api/teams returns every team via TeamsService.findAll(); GET /api/teams/:teamId, :teamId/members, and :teamId/members/:userId answer for any team. Any authenticated user can enumerate all teams and their full member records.

No consumer breakage: grep across apps/packages/plugins finds zero callers of /api/teams outside the controller itself.

Fix (PR follows): scope list to the requester's memberships (admins keep findAll); per-team routes require admin or membership (404 missing / 403 no-access, same convention as the projects controller); membership self-lookup stays open.

Found by the webUI audit (lane webui-audit, A3 finding F9.2; severity upgraded to MAJOR in P2 cross-review). **Measured:** every route in `apps/gateway/src/workspace/teams.controller.ts` is behind AuthGuard only, with no membership scoping: `GET /api/teams` returns every team via `TeamsService.findAll()`; `GET /api/teams/:teamId`, `:teamId/members`, and `:teamId/members/:userId` answer for any team. Any authenticated user can enumerate all teams and their full member records. **No consumer breakage:** grep across apps/packages/plugins finds zero callers of `/api/teams` outside the controller itself. **Fix (PR follows):** scope list to the requester's memberships (admins keep findAll); per-team routes require admin or membership (404 missing / 403 no-access, same convention as the projects controller); membership self-lookup stays open.
fred closed this issue 2026-08-26 22:45:56 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1428