eab1d77582
Index: 47 open (8 critical, 39 major), 6 resolved. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
43 lines
1.4 KiB
Markdown
43 lines
1.4 KiB
Markdown
---
|
|
issue: 006
|
|
title: "GET /api/admin/scanner/status has no authentication middleware despite /api/admin/ prefix"
|
|
severity: critical
|
|
domain: Admin
|
|
labels: [security, bug, backend, critical, missing-auth]
|
|
status: resolved
|
|
resolved: 2026-05-29
|
|
fix: "Added authenticateToken + authorizeRoles('admin') inline to the scanner status proxy route in app.ts"
|
|
created: 2026-05-29
|
|
source: Doc vs Code Audit 2026-05-29
|
|
---
|
|
|
|
# 🔴 GET /api/admin/scanner/status has no authentication middleware despite /api/admin/ prefix
|
|
|
|
**Severity:** critical
|
|
**Domain:** Admin
|
|
**Labels:** security, bug, backend, critical, missing-auth
|
|
|
|
## Description
|
|
|
|
The scanner status proxy endpoint at GET /api/admin/scanner/status proxies directly to AMN_SCANNER_URL without any authentication check, despite sitting under the /api/admin/ route prefix which conventionally requires admin auth.
|
|
|
|
## Current Behavior
|
|
|
|
Returns scanner data (200) to any unauthenticated request.
|
|
|
|
## Expected Behavior
|
|
|
|
Return 401 without Authorization header, 403 for non-admin token. Apply authenticateToken + authorizeRoles('admin').
|
|
|
|
## Reproduction Steps
|
|
|
|
curl https://api.example.com/api/admin/scanner/status — should return 401, currently returns scanner data.
|
|
|
|
## Affected Files
|
|
|
|
- `backend/src/routes/adminRoutes.ts`
|
|
|
|
## References
|
|
|
|
- [Doc vs Code Audit Report](../09%20-%20Audits/Doc%20vs%20Code%20Audit%20Report%20-%202026-05-29.md)
|