---
issue: 006
title: "GET /api/admin/scanner/status has no authentication middleware despite /api/admin/ prefix"
severity: critical
domain: Admin
labels: [security, bug, backend, critical, missing-auth]
status: resolved
resolved: 2026-05-29
fix: "Added authenticateToken + authorizeRoles('admin') inline to the scanner status proxy route in app.ts"
created: 2026-05-29
source: Doc vs Code Audit 2026-05-29
---

# 🔴 GET /api/admin/scanner/status has no authentication middleware despite /api/admin/ prefix

**Severity:** critical
**Domain:** Admin
**Labels:** security, bug, backend, critical, missing-auth

## Description

The scanner status proxy endpoint at GET /api/admin/scanner/status proxies directly to AMN_SCANNER_URL without any authentication check, despite sitting under the /api/admin/ route prefix which conventionally requires admin auth.

## Current Behavior

Returns scanner data (200) to any unauthenticated request.

## Expected Behavior

Return 401 without Authorization header, 403 for non-admin token. Apply authenticateToken + authorizeRoles('admin').

## Reproduction Steps

curl https://api.example.com/api/admin/scanner/status — should return 401, currently returns scanner data.

## Affected Files

- `backend/src/routes/adminRoutes.ts`

## References

- [Doc vs Code Audit Report](../09%20-%20Audits/Doc%20vs%20Code%20Audit%20Report%20-%202026-05-29.md)