| Title | dibo-software diboot v3.8.0 Broken Access Control |
|---|
| Description | The tenant resource assignment endpoints expose a tenant-scoped Broken Access Control issue. The controller accepts a caller-supplied tenantId directly in both the read and write routes,then forwards it to the service layer without checking whether the authenticated user actually owns that tenant or has any management authority over it. In GET /api/iam/tenant/resource/{tenantId}, the API returns the tenant’s current resource IDs by querying only on tenantId. In POST /api/iam/tenant/resource/{tenantId}, the API rewrites the many-to-many tenant-resource mapping by passing the same tenantId and attacker-controlled ids list into the relation update helper. Because there is no object-level permission check and no tenant boundary validation, any authenticated user who knows or guesses a valid tenantId can enumerate that tenant’s authorization set and arbitrarily grant or revoke permissions. |
|---|
| Source | ⚠️ https://drive.google.com/file/d/1qFtwq78JN5Af3GlSD2utfQIbOPBaaQ47/view?usp=sharing |
|---|
| User | Stephen Lin (UID 98370) |
|---|
| Submission | 07/01/2026 09:41 (2 months ago) |
|---|
| Moderation | 08/31/2026 07:33 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 397235 [dibo-software diboot 3.8.0 Tenant Resource Assignment /api/iam/tenant/resource tenantId access control] |
|---|
| Points | 20 |
|---|