Gửi #862562: letta-ai LettaBot 0.2.0 Missing Authentication for Critical Function (CWE-306)

# Technical Details
An Unauthenticated Portal Management Endpoint Access exists in the `GET /api/v1/pairing/:channel` and `GET /api/v1/status` routes in `src/api/server.ts` of LettaBot.

The application fails to enforce API key authentication on portal-backed read endpoints when the agent conversation mode is `shared` (the default). Both routes conditionally skip API key validation when `getPortalMode(options)` resolves to `shared`: `if (getPortalMode(options) !== 'shared' && !validateApiKey(req.headers, options.apiKey))`. In default shared mode, the authorization branch is skipped entirely, allowing unauthenticated remote callers to query pairing request listings and agent status metadata.

# Vulnerable Code
File: src/api/server.ts
Method: GET /api/v1/pairing/:channel handler (line ~449-456) and GET /api/v1/status handler (line ~707-714); getPortalMode() (line ~928-934)
Why: The mode-gated authorization check only rejects unauthenticated requests when mode is NOT shared. In the default shared mode, the guard evaluates `getPortalMode(options) !== 'shared'` as `false`, short-circuits the AND, and skips API key validation entirely.

# Reproduction
1. Deploy LettaBot with default `shared` conversation mode.
2. Send unauthenticated GET requests to `/api/v1/pairing/:channel` and `/api/v1/status`.
3. Observe HTTP 200 responses containing pairing request data and agent metadata (agentId, conversationId, channels, baseUrl, timestamps).
4. Switch to `per-channel` mode and confirm the same requests return 401 Unauthorized.

# Impact
- Remote unauthenticated enumeration of management-plane metadata including pairing state and internal agent status.
- Exposes deployment topology, active channels, conversation identifiers, and service base URLs.
- Assists follow-on targeting by revealing internal infrastructure details.

• Nguồn: ⚠️ https://gist.github.com/YLChen-007/2ba2e586f3d16cb368c8dcd6ef680178
• Người dùng: JohnChen (UID 99088)
• Đệ trình: 18/06/2026 08:50 (cách đây 2 các tháng)
• Kiểm duyệt: 05/08/2026 20:44 (2 months later)
• Trạng thái: được chấp nhận
• Mục VulDB: 386359 [letta-ai LettaBot 0.2.0 API Status Route src/api/server.ts xác thực yếu]
• điểm: 20