CRITICAL: Unauthenticated user CRUD via integer-ID /users/ router

[Galaxync]

Summary

The users router exposes PUT and DELETE operations on user records with no authentication or authorization dependency. The GET endpoints use sequential integer IDs, enabling simple user enumeration. No Depends(current_user) is applied to any endpoint in this router.

Location

• Backend/FastAPI/routers/users.py:62-86

Vulnerable Endpoints

• GET /users - list all users
• GET /user/{id} - get user by sequential integer ID
• PUT /user/ - full replace of any user by integer ID
• DELETE /user/{id} - delete any user

CWE

CWE-306 (Missing Authentication), CWE-639 (IDOR), CWE-269 (Privilege Escalation)

Exploitation

1. Enumerate all users: GET /users or GET /user/1, GET /user/2, GET /user/3 - sequential IDs make enumeration trivial
2. Modify any user: PUT /user/ with body {"id": 2, "name":"pwned", "url":"http://evil.com"} overwrites user 2
3. Delete any user: DELETE /user/2 permanently removes user 2

Impact

Full account takeover and data breach via user enumeration and arbitrary modification/deletion of all user records.