[Security][High] No role-based authorization — editor role is never enforced #10

New Issue

wtclaude · 2026-07-02T01:20:44Z

wtclaude commented

2026-07-02 01:20:44 +00:00

Severity: High · Type: Security / access control

Problem

isLoggedIn (server/src/utils/auth.js:81) only verifies that the JWT is valid. Every admin route is gated by isLoggedIn alone (server/src/router/v1/admin/admin.routes.js:15). The system defines two roles (admin, editor), but no route ever checks req.user.role — the only role logic is two narrow "last admin" guards in admin.controller.js.

Impact

A low-privilege editor can call any admin endpoint:

POST /admin/users — create a new admin
PUT /admin/users/:id — promote themselves to admin
DELETE /admin/users/:id — delete other users
PUT /admin/site-mode — flip the site in/out of maintenance
delete any wiki page, etc.

This is a privilege-escalation hole: any authenticated non-admin effectively has full admin power.

Suggested fix

Add a role-gate middleware and apply it to admin-only routes (/users/*, /site-mode, and anything else that should be admin-only):

function requireRole(...roles) {
  return (req, res, next) =>
    roles.includes(req.user?.role) ? next() : res.status(403).json({ message: 'Forbidden' })
}

Decide per-route which operations editor may perform (likely content: posts/wiki) vs. admin-only (users, site mode, settings).

**Severity:** High · **Type:** Security / access control ## Problem `isLoggedIn` (`server/src/utils/auth.js:81`) only verifies that the JWT is valid. Every admin route is gated by `isLoggedIn` alone (`server/src/router/v1/admin/admin.routes.js:15`). The system defines two roles (`admin`, `editor`), but **no route ever checks `req.user.role`** — the only role logic is two narrow "last admin" guards in `admin.controller.js`. ## Impact A low-privilege `editor` can call any admin endpoint: - `POST /admin/users` — create a new admin - `PUT /admin/users/:id` — promote themselves to admin - `DELETE /admin/users/:id` — delete other users - `PUT /admin/site-mode` — flip the site in/out of maintenance - delete any wiki page, etc. This is a privilege-escalation hole: any authenticated non-admin effectively has full admin power. ## Suggested fix Add a role-gate middleware and apply it to admin-only routes (`/users/*`, `/site-mode`, and anything else that should be admin-only): ```js function requireRole(...roles) { return (req, res, next) => roles.includes(req.user?.role) ? next() : res.status(403).json({ message: 'Forbidden' }) } ``` Decide per-route which operations `editor` may perform (likely content: posts/wiki) vs. admin-only (users, site mode, settings).

wtclaude referenced this issue from a commit

2026-07-03 02:19:20 +00:00

Enforce role-based authorization on admin-only routes (#10)

wtclaude referenced a pull request that will close this issue

2026-07-03 02:22:20 +00:00

Enforce role-based authorization on admin-only routes (fixes #10) #15

wtclaude referenced this issue

2026-07-03 02:23:02 +00:00

Re-validate JWT against the DB in isLoggedIn (fixes #12) #16

whitlocktech closed this issue

2026-07-03 02:31:09 +00:00

whitlocktech referenced this issue from a commit