Summary
Phproject's REST API issue endpoints may fail to enforce object-level authorization before returning restricted issue data or accepting comments. An authenticated user with a valid API key could read protected issue content and comments, including email addresses, or post comments to issues outside their permitted access.
Affected context
The vulnerability occurs in Phproject deployments before 1.8.7 when the REST API endpoints for retrieving issues, reading comments, or posting comments do not invoke the application's access-control routine. The risk depends on the API being reachable by a user who possesses a valid API key and on restricted issues being available through the affected endpoints.
Exploit preconditions
- Attack surface: REST API issue endpoints, including single issue retrieval and comment operations
- Required access: A valid authenticated API key
- Trigger point: Requests to retrieve restricted issues or comments, or to submit comments
- Authorization condition: The target issue must be subject to access restrictions
- Why exploitation is possible: Endpoint handling may omit the required object-level authorization check before reading or modifying the issue resource
Why this happens
The underlying flaw is a missing authorization check on individual resources. The affected endpoints do not consistently invoke the application's access-control routine before processing requests, allowing authentication to be treated as sufficient permission for actions that require authorization against a specific issue. This maps to CWE-862: Missing Authorization, with the object-level failure commonly described as broken object-level authorization.
Potential impact
- Attackers may read restricted issue descriptions and comments
- Sensitive owner or author email addresses could be disclosed
- Unauthorized comments may be added to protected issues
- Confidentiality and integrity of project discussions may be reduced
- Exposed information could support further targeted attacks
General mitigation guidance
Mitigation generally focuses on enforcing authorization for every object-level API operation rather than relying on authentication alone.
Common defensive patterns include:
- Applying centralized, deny-by-default authorization checks to read and write operations
- Verifying the requesting principal's relationship to the specific issue before returning or modifying it
- Ensuring all equivalent endpoint variants use the same authorization policy
- Minimizing sensitive fields returned to clients, including unnecessary email addresses
- Using least-privilege API keys with narrowly scoped permissions
- Treating authorization failures consistently and avoiding resource existence leakage
How teams detect issues like this
Organizations can look for missing object-level authorization through:
- Static analysis and code review checks for endpoint handlers that access issue records without calling a shared authorization function
- Tests that compare access to authorized, unauthorized, and nonexistent issue identifiers
- API integration tests covering read, comment retrieval, and comment creation paths
- Monitoring for authenticated requests accessing many unrelated or restricted issue identifiers
- Policy enforcement requiring explicit authorization checks before sensitive database reads or writes
Automated review tools may help identify endpoint paths where authentication checks are present but resource-level authorization is absent.
