From 24cced0c8c806800f79cc2d8462ab0a193ddebcd Mon Sep 17 00:00:00 2001 From: jamesread Date: Thu, 26 Feb 2026 20:23:48 +0000 Subject: [PATCH] security: IDOR on ExecutionStatus API --- service/internal/api/api.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/service/internal/api/api.go b/service/internal/api/api.go index 911f2ab..339cbc4 100644 --- a/service/internal/api/api.go +++ b/service/internal/api/api.go @@ -384,10 +384,11 @@ func (api *oliveTinAPI) ExecutionStatus(ctx ctx.Context, req *connect.Request[ap if ile == nil { return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("execution not found for tracking ID %s or action ID %s", req.Msg.ExecutionTrackingId, req.Msg.ActionId)) - } else { - res.LogEntry = api.internalLogEntryToPb(ile, user) } - + if !isValidLogEntry(ile) || !api.isLogEntryAllowed(ile, user) { + return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied to view this execution")) + } + res.LogEntry = api.internalLogEntryToPb(ile, user) return connect.NewResponse(res), nil }