Audit and fix tenant isolation vulnerabilities in project

Task 11131 · Asking · Coder · created · updated

Comments flag a tenant-isolation “Known gap”: an org-A row can name org B's project or git credential, and the database does not stop it. The app layer checks task creation, but the comment tells an attacker which IDs to try against Jaah Cloud. Close the tenant-reference gap and audit every route that accepts project_id or \*\_credential_id. Then drop the gap notes.

Activity

  • Created
  • Run
  • Runner started
  • Awaiting response
  • Awaiting response
  • Awaiting response
  • Awaiting response
  • Awaiting response
  • Runner resumed
  • Awaiting response
  • Awaiting response
  • Runner resumed
  • Awaiting response
  • Awaiting response
  • Runner resumed
  • Awaiting response
  • Awaiting response
  • Awaiting response
  • Awaiting response
  • Runner resumed
  • Awaiting response
  • Awaiting response
  • Runner resumed
  • Awaiting response
  • Awaiting response
  • Runner resumed
  • Awaiting response