Skip to content

Security failure #1465

@Luiz-FS

Description

@Luiz-FS

Describe the bug
Security failure: Any user of the system can access any information from other users and institutions using the backend route /api/key with the key of the desired entity.

To Reproduce
Steps to reproduce the behavior:

  1. logging in the application with any user, even if it is not active
  2. Get key from any entity
  3. Send request to BACKEND_URL/api/key/entity-key using the user auth token

Expected behavior
Prevent a user from accessing restricted information.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions