@mention notifications leak confidential/internal ticket content to users with no access — worse than #46 #69

Open
opened 2026-09-01 00:07:08 -04:00 by jared · 0 comments
Owner

Severity: High

helpers/NotificationHelper.php::sendMentionNotification() (~lines 139-154), called from api/add_comment.php:185 with no visibility check or parameter at all. Unlike sendCommentNotification()/notifyWatchers() (which redact the comment preview for non-public tickets), this function always sends the full 200-char comment preview + ticket title as a Matrix DM directly to the mentioned user.

Impact: Commenting @bob check this out on a confidential ticket Bob has no access to (not creator/assignee/admin, not in visibility_groups) sends Bob a Matrix DM with the ticket's title AND the comment text — de facto visibility into content canUserAccessTicket() would otherwise deny him entirely. This is a more severe instance of the pattern in #46 (which only leaks the title to a shared list) since it delivers both title and comment body directly to an individual with zero standing access.

Fix: Before sending a mention notification, verify the mentioned user actually has access to the ticket (canUserAccessTicket()); if not, either skip the notification or send a heavily redacted version (e.g. "You were mentioned on a ticket you don't have access to") with no title/content.

**Severity:** High `helpers/NotificationHelper.php::sendMentionNotification()` (~lines 139-154), called from `api/add_comment.php:185` with no visibility check or parameter at all. Unlike `sendCommentNotification()`/`notifyWatchers()` (which redact the comment preview for non-public tickets), this function always sends the full 200-char comment preview + ticket title as a Matrix DM directly to the mentioned user. **Impact:** Commenting `@bob check this out` on a confidential ticket Bob has no access to (not creator/assignee/admin, not in `visibility_groups`) sends Bob a Matrix DM with the ticket's title AND the comment text — de facto visibility into content `canUserAccessTicket()` would otherwise deny him entirely. This is a more severe instance of the pattern in #46 (which only leaks the title to a shared list) since it delivers both title and comment body directly to an individual with zero standing access. **Fix:** Before sending a mention notification, verify the mentioned user actually has access to the ticket (`canUserAccessTicket()`); if not, either skip the notification or send a heavily redacted version (e.g. "You were mentioned on a ticket you don't have access to") with no title/content.
jared added the notificationspriority/highsecurity labels 2026-09-08 10:15:47 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#69