12348ebb80
Both dispute privilege-escalation issues fixed in backend disputeRoutes.ts. Index updated: 51 open (12 critical), 2 resolved. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
40 lines
1.5 KiB
Markdown
40 lines
1.5 KiB
Markdown
---
|
|
issue: 001
|
|
title: "PATCH /api/disputes/:id/status and POST /api/disputes/:id/resolve have no role guard — privilege escalation"
|
|
severity: critical
|
|
domain: Dispute
|
|
labels: [security, bug, backend, privilege-escalation]
|
|
status: resolved
|
|
resolved: 2026-05-29
|
|
fix: "Added authorizeRoles('admin') middleware to PATCH /:id/status and POST /:id/resolve in backend/src/routes/disputeRoutes.ts"
|
|
created: 2026-05-29
|
|
source: Doc vs Code Audit 2026-05-29
|
|
---
|
|
|
|
# 🔴 PATCH /api/disputes/:id/status and POST /api/disputes/:id/resolve have no role guard — privilege escalation
|
|
|
|
**Severity:** critical
|
|
**Domain:** Dispute
|
|
**Labels:** security, bug, backend, privilege-escalation
|
|
|
|
## Description
|
|
|
|
Any authenticated buyer or seller can change dispute status to 'resolved', 'closed', or 'rejected', and can post a dispute resolution including action=ban_seller. Neither the dashboard updateStatus controller nor the resolveDispute controller call authorizeRoles('admin'). Only authenticateToken is applied on the router.
|
|
|
|
## Current Behavior
|
|
|
|
Any authenticated user with the dispute ID can call PATCH /api/disputes/:id/status or POST /api/disputes/:id/resolve and receive 200 with the mutation applied.
|
|
|
|
## Expected Behavior
|
|
|
|
Both endpoints should return 403 for non-admin users. authorizeRoles('admin') middleware should be applied at the route level.
|
|
|
|
## Affected Files
|
|
|
|
- `backend/src/routes/disputeRoutes.ts`
|
|
- `backend/src/controllers/disputeController.ts`
|
|
|
|
## References
|
|
|
|
- [Doc vs Code Audit Report](../09%20-%20Audits/Doc%20vs%20Code%20Audit%20Report%20-%202026-05-29.md)
|