| Title | MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df Missing Authentication |
|---|
| Description | The affected component is `routes/api.php`, where the entire `files` resource is registered without any authentication middleware, while only the `/api/user` route is protected:
```php
Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
return $request->user();
});
Route::apiResource('files', FileController::class);
```
`app/Http/Controllers/FileController.php` therefore exposes all CRUD operations to unauthenticated callers: `index()` lists every stored file with its name, path, type and size; `store()` uploads files; `update()` renames any file; `destroy()` deletes any file record and its physical file on disk. An unauthenticated attacker can enumerate, upload, rename, and delete all files of the application with plain HTTP requests.
|
|---|
| Source | ⚠️ https://github.com/MomoTommy/file-management-system/issues/1 |
|---|
| User | wukong1233333333 (UID 101975) |
|---|
| Submission | 10/07/2026 16:17 (27 days ago) |
|---|
| Moderation | 10/21/2026 08:55 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424693 [MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df Files API FileController.php index/store/update/destroy request missing authentication] |
|---|
| Points | 20 |
|---|