Fix BOLA in /api/session endpoint allowing unauthorized access to other users' session data

Vulnerability Overview This vulnerability involves the project, where the endpoint does not correctly restrict access to session details, allowing users to retrieve session data belonging to other users. Specifically, when a user requests session details via the endpoint, the system fails to verify whether the requested session belongs to the current user's active profile, thereby permitting access to other users' session data. Impact Scope Impact Level: Medium Impact Description: Users can retrieve session data belonging to other users using known or guessed session IDs, even if this data is filtered out by the endpoint. CVSS Score: 6.5 (Medium) Remediation 1. Add Active Profile Check: Immediately after loading the session in the endpoint, verify whether the session belongs to the current user's active profile. 2. Return 404 Error: If the session does not belong to the current user's active profile, return a 404 error to avoid confirming the existence of cross-session sessions. 3. Add Regression Tests: Ensure that the patched code correctly handles cross-session session scenarios. Code Changes File: Change Details: - Add an active profile check immediately after loading the session in the endpoint. - Return a 404 error if the session does not belong to the current user's active profile. Test Plan New Regression Tests: Ensure the patched code correctly handles cross-session session scenarios. Profile Filtering Test Module: Ensure profile filtering functionality works correctly. Load Test: Ensure load testing for the endpoint passes. Security Reproduction Steps 1. Create or simulate a session marked as belonging to a non-active profile. 2. Set the request's active profile to the default value. 3. Invoke . 4. Pre-fix: The endpoint returns a JSON session payload. 5. Post-fix: The endpoint returns a 404 error with no session payload. Expected Vulnerable Behavior The direct session detail endpoint should not disclose sessions hidden by the profile filtering. Pre-fix: The route returns 200 with a cross-session session payload. The security signal for regression tests is that the pre-fix route call follows the JSON response path, while the post-fix call follows the 404 path. Change Summary Add an active profile check immediately after loading the session in the endpoint. Return a 404 error to avoid confirming the existence of cross-session sessions. Add regression tests to ensure cross-session sessions do not generate JSON session payloads. File Changes API Guard: - Add an active profile check immediately after loading the session in the endpoint. Regression Test: - Ensure cross-session sessions return a 404 error with no JSON session payload. Maintainer Impact Narrow API behavioral change: endpoint. No storage migrations, frontend changes, or CLI behavioral changes. Legacy/default profile aliases continue to be supported via the existing helper function. Remediation Rationale The session detail endpoint is the correct boundary, as it translates the raw into session data. Reusing avoids duplicating profile semantics and preserves compatibility with renamed root profiles. Regression tests directly verify the bypass scenario: a cross-session session ID combined with a non-matching active profile should not serialize the session. Change Type Security fix Tests Documentation updates Refactoring without behavioral changes Test Plan New Regression Tests: Ensure the patched code correctly handles cross-session session scenarios. Profile Filtering Test Module: Ensure profile filtering functionality works correctly. Load Test: Ensure load testing for the endpoint passes. Disclosure Notes This PR maintains the claim of active profile authorization for the session detail endpoint. Production systems were not tested. No secrets or real session content are included in the tests or PR description. Unrelated files were not modified. Code Block

Goal Reached Thanks to every supporter — we hit 100%!

Fix BOLA in /api/session endpoint allowing unauthorized access to other users' session data

More from this source