---
issue: 025
title: "GET /api/disputes/statistics has no admin role guard — any authenticated user can access aggregate dispute KPIs"
severity: major
domain: Dispute
labels: [security, bug, backend, major, privilege-escalation]
status: open
created: 2026-05-29
source: Doc vs Code Audit 2026-05-29
---

# 🟠 GET /api/disputes/statistics has no admin role guard — any authenticated user can access aggregate dispute KPIs

**Severity:** major
**Domain:** Dispute
**Labels:** security, bug, backend, major, privilege-escalation

## Description

Backend registers GET /api/disputes/statistics with authenticateToken only. No authorizeRoles(admin) guard is applied at the route or controller level. Any authenticated non-admin user can access aggregate dispute platform data.

## Current Behavior

Non-admin authenticated users can call GET /api/disputes/statistics and receive platform-wide KPI data.

## Expected Behavior

Return 403 for non-admin tokens. Apply authorizeRoles('admin') at the route level.

## Affected Files

- `backend/src/routes/disputeRoutes.ts`

## References

- [Doc vs Code Audit Report](../09%20-%20Audits/Doc%20vs%20Code%20Audit%20Report%20-%202026-05-29.md)