Skip to content

Security failure #1465

Open
Open
@Luiz-FS

Description

@Luiz-FS

Describe the bug
Security failure: Any user of the system can access any information from other users and institutions using the backend route /api/key with the key of the desired entity.

To Reproduce
Steps to reproduce the behavior:

  1. logging in the application with any user, even if it is not active
  2. Get key from any entity
  3. Send request to BACKEND_URL/api/key/entity-key using the user auth token

Expected behavior
Prevent a user from accessing restricted information.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions