[BUG] User can escalate theirs privilege #46

New issue

Open

opened 2026-08-03 17:44:12 +00:00 by PoweredDeveloper · 0 comments

PoweredDeveloper commented

2026-08-03 17:44:12 +00:00

Owner

Describe the bug
Self-service privilege escalation via PATCH /users/me — backend/src/modules/users/schemas.py:22-27 defines UserUpdate with role, balance, status, subscription_id, and routes.py:45-64 applies it to the caller's own account. Any authenticated user can set their own role: "admin" and balance to anything. PATCH /users/{id} (routes.py:182-211) has the same flaw.

Make separate authentication token for admin. usual users shouldn be able to call /users/{id} endpoints. i.e. PATCH /users/{id} (routes.py:182-211).

If admin calls GET /users/{id} - show all fields.
If user calls GET /users/{id} - show safe fields, if user calls itself, show all fields.

# Add checks to admin enpoints
current_user.role == UserRole.ADMIN

Admin role is never enforced — UserRole.ADMIN exists but no endpoint checks it. Package CRUD, GET /users, GET /payments are "admin" by shared-secret only.

Checklist

I have searched for existing issues (including closed ones)
I can reproduce the issue on a fresh installation or latest version

**Describe the bug** Self-service privilege escalation via PATCH /users/me — backend/src/modules/users/schemas.py:22-27 defines UserUpdate with role, balance, status, subscription_id, and routes.py:45-64 applies it to the caller's own account. Any authenticated user can set their own role: "admin" and balance to anything. PATCH /users/{id} (routes.py:182-211) has the same flaw. Make separate authentication token for admin. usual users shouldn be able to call /users/{id} endpoints. i.e. PATCH /users/{id} (routes.py:182-211). - If admin calls `GET /users/{id}` - show all fields. - If user calls `GET /users/{id}` - show safe fields, if user calls itself, show all fields. ```python # Add checks to admin enpoints current_user.role == UserRole.ADMIN ``` Admin role is never enforced — UserRole.ADMIN exists but no endpoint checks it. Package CRUD, GET /users, GET /payments are "admin" by shared-secret only. **Checklist** - [x] I have searched for existing issues (including closed ones) - [ ] I can reproduce the issue on a fresh installation or latest version

PoweredDeveloper added this to the Sprint 1 milestone

2026-08-03 17:44:12 +00:00

PoweredDeveloper added the

security

bug

backend

labels

2026-08-03 17:44:12 +00:00