| शीर्षक | RYMCU forest V1.0 Missing Authentication |
|---|
| विवरण | The application contains a critical security flaw in the bank management API where ANY authenticated user (regardless of role) can access sensitive financial information including all bank accounts, account balances, bank owners, and transaction details. This endpoint is located under /api/v1/admin/bank/ path, clearly indicating it should be restricted to administrators, yet while JWT authentication is enforced by Shiro filter chain, there is NO role-based authorization check to ensure the user is an administrator. |
|---|
| स्रोत | ⚠️ https://github.com/rymcu/forest/issues/198 |
|---|
| उपयोगकर्ता | 1098024193 (UID 45260) |
|---|
| सबमिशन | 23/10/2025 11:34 AM (12 महीनों पहले) |
|---|
| संयम | 09/11/2025 07:53 AM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 331644 [rymcu forest तक de53ce79db9faa2efc4e79ce1077a302c42a1224 BankController.java GlobalResult अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|