RockteMQ-AI commented on issue #1714: URL: https://github.com/apache/rocketmq-dashboard/issues/1714#issuecomment-5251745699
**Issue Evaluation** Category: `type/bug` (security) | Severity: **High** | Status: **Confirmed** The authorization gap is clear: `AuthInterceptor` currently permits authenticated non-admin readers to invoke cloud catalog endpoints (`/api/cloud/aliyun/regions`, `/api/cloud/aliyun/instances`, `/api/cloud/tencent/regions`, `/api/cloud/tencent/instances`). These endpoints use stored cloud credentials (access key + secret) to call cloud-provider APIs, so exposing them to non-admin users effectively grants indirect access to cloud inventory browsing through the backend. **Root Cause:** The cloud catalog GET path prefixes are not included in the admin-only route guard in `AuthInterceptor`. **Impact:** Any authenticated non-admin user can enumerate cloud regions and instances via stored credentials, violating the principle of least privilege. **Proposed Fix Assessment:** The proposed approach — treating both cloud catalog path prefixes as administrator-only and adding regression tests — is correct and minimal. This is a valid security issue. A fix PR is welcome. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
