api/get_users.php: unrestricted user enumeration, no pagination or admin gate #42

New Issue

2026-08-31T21:29:47-04:00

jared commented

2026-08-31 21:29:47 -04:00

Severity: Low

api/get_users.php returns every user's user_id/username/display_name to any authenticated session, with no admin gate, no pagination, and no field limiting. Needed for mention/assignment typeahead, but it's a blanket enumeration endpoint that a compromised low-privilege session could scrape in a single call. Low severity since the app is fully behind Authelia SSO, but worth tightening (e.g. require a search-query prefix rather than returning the full list, or cap the result count) as defense-in-depth.

**Severity:** Low `api/get_users.php` returns every user's `user_id`/`username`/`display_name` to any authenticated session, with no admin gate, no pagination, and no field limiting. Needed for mention/assignment typeahead, but it's a blanket enumeration endpoint that a compromised low-privilege session could scrape in a single call. Low severity since the app is fully behind Authelia SSO, but worth tightening (e.g. require a search-query prefix rather than returning the full list, or cap the result count) as defense-in-depth.

jared added the priority/low security labels 2026-09-08 10:15:44 -04:00

jared referenced this issue from a commit

2026-09-08 11:59:38 -04:00

Cap get_users.php result set as defense-in-depth (#42)

jared referenced this issue from a commit

2026-09-08 15:39:42 -04:00

Merge development into main: 15-issue triage + fix batch

Sign in to join this conversation.