BG-003 · backend/auth.py:87

Broken Authorization

HIGH✓ FIXED

Vulnerability description

Endpoint verifies authentication but never checks that the caller owns the requested resource.

Security impact

Any authenticated user can read and update another tenant's records by changing the object id in the request (IDOR).

Recommended remediation

Enforce an ownership check on every object lookup before mutating or returning data.

Fix

Before

@require_login
def update_account(account_id, payload):
    return db.accounts.update(account_id, payload)

After

@require_login
def update_account(account_id, payload, current_user):
    account = db.accounts.get(account_id)
    if account.owner_id != current_user.id:
        raise Forbidden()
    return db.accounts.update(account_id, payload)

Regression test

test_user_cannot_update_foreign_account

def test_user_cannot_update_foreign_account(client, alice, bob):
    resp = client.patch(f"/api/accounts/{bob.account_id}", auth=alice)
    assert resp.status_code == 403

Affected file

backend/auth.py

Line 87

Affected code path

PATCH /api/accounts/:id → require_login() → accounts.update(id, payload)

Verification result

✓Regression test generated
✓Test passed
✓Fix verified