提交 #862562: letta-ai LettaBot 0.2.0 Missing Authentication for Critical Function (CWE-306)

# Technical Details
An Unauthenticated Portal Management Endpoint Access exists in the `GET /api/v1/pairing/:channel` and `GET /api/v1/status` routes in `src/api/server.ts` of LettaBot.

The application fails to enforce API key authentication on portal-backed read endpoints when the agent conversation mode is `shared` (the default). Both routes conditionally skip API key validation when `getPortalMode(options)` resolves to `shared`: `if (getPortalMode(options) !== 'shared' && !validateApiKey(req.headers, options.apiKey))`. In default shared mode, the authorization branch is skipped entirely, allowing unauthenticated remote callers to query pairing request listings and agent status metadata.

# Vulnerable Code
File: src/api/server.ts
Method: GET /api/v1/pairing/:channel handler (line ~449-456) and GET /api/v1/status handler (line ~707-714); getPortalMode() (line ~928-934)
Why: The mode-gated authorization check only rejects unauthenticated requests when mode is NOT shared. In the default shared mode, the guard evaluates `getPortalMode(options) !== 'shared'` as `false`, short-circuits the AND, and skips API key validation entirely.

# Reproduction
1. Deploy LettaBot with default `shared` conversation mode.
2. Send unauthenticated GET requests to `/api/v1/pairing/:channel` and `/api/v1/status`.
3. Observe HTTP 200 responses containing pairing request data and agent metadata (agentId, conversationId, channels, baseUrl, timestamps).
4. Switch to `per-channel` mode and confirm the same requests return 401 Unauthorized.

# Impact
- Remote unauthenticated enumeration of management-plane metadata including pairing state and internal agent status.
- Exposes deployment topology, active channels, conversation identifiers, and service base URLs.
- Assists follow-on targeting by revealing internal infrastructure details.

• 来源: ⚠️ https://gist.github.com/YLChen-007/2ba2e586f3d16cb368c8dcd6ef680178
• 用户: JohnChen (UID 99088)
• 提交: 2026-06-18 08時50分 (2 月前)
• 管理: 2026-08-05 20時44分 (2 months later)
• 状态: 已接受
• VulDB条目: 386359 [letta-ai LettaBot 0.2.0 API Status Route src/api/server.ts 弱身份验证]
• 积分: 20