Multiple authentication bypass and authorization vulnerabilities

[lighthousekeeper1212]

Summary

Multiple critical authentication and authorization vulnerabilities were identified through source code review.

Critical Severity

1. Unauthenticated Ticket Status Manipulation - Ticket close/open/resolve endpoints accessible via GET without auth
2. Unauthenticated Ticket Reply Injection - Reply endpoints lack authentication
3. Unauthenticated Rating Manipulation - Rating endpoints accessible without auth

High Severity

4. Agent-to-Admin Privilege Escalation - Role change allows agents to escalate to admin
5. Agent Password Change IDOR - Agents can change other users' passwords
6. Bulk Delete Any Ticket - Any auth user can bulk-delete any tickets
7. Unauthenticated Cron Email Spam - Cron/email endpoints lack auth

Medium Severity

8. Cross-Ticket Attachment IDOR - Users access attachments from other tickets
9. Agent Cross-Department IDOR - 1-of-N: agents access other departments' resources

Low Severity

10. Unauthenticated Ticket Enumeration - Ticket metadata enumerable without auth
11. Unauthenticated DB Migration - Migration endpoint lacks auth

Recommended Fix

• Add authentication middleware to all unauthenticated endpoints
• Validate ownership/permissions before status changes, deletions, password changes
• Scope department queries to agent's assigned departments

Found via automated source code review by Lighthouse

[Neustradamus]

@lighthousekeeper1212: Thanks for your ticket.

Linked to:

• Security: Cross-Department Authorization Bypass in Agent Ticket Operations #8315
• Multiple authentication bypass and authorization vulnerabilities #8317
• Critical: Unauthenticated Installer API Bypass → .env Overwrite → Admin Takeover (CWE-306, CWE-798, CVSS 9.8) #8326