[changebeacon] Dashboard endpoints lack authentication #38

New issue

Closed

opened 2026-03-03 03:06:49 +00:00 by ash · 0 comments

ash commented

2026-03-03 03:06:49 +00:00

Owner

Security Concern

Dashboard mutation endpoints (DashboardCreateEntry, DashboardUpdateEntry, DashboardDeleteEntry) do not check API keys or session auth.

Anyone who can reach the dashboard can create/update/delete changelog entries.

Severity: HIGH.

Fix

Add authentication middleware to all dashboard mutation routes.

Found by Red Team Audit 2026-03-03.

## Security Concern Dashboard mutation endpoints (`DashboardCreateEntry`, `DashboardUpdateEntry`, `DashboardDeleteEntry`) do not check API keys or session auth. Anyone who can reach the dashboard can create/update/delete changelog entries. Severity: HIGH. ### Fix Add authentication middleware to all dashboard mutation routes. Found by Red Team Audit 2026-03-03.