/admin reads are not org-scoped, leaking data across tenants #4

Open
opened 2026-08-19 22:06:53 -04:00 by logan · 1 comment
Owner

The /admin Users, Audit and Correlation views query without an org_id filter, so they return data across every org. routers/users.py:57-70 lists all Firebase users fleet-wide and never shows which org a user belongs to.

This is the same failure mode SAAS_PLAN.md flagged before the tenancy work, simply missed on the admin side during the org_id pass. It becomes a real leak the moment a second org exists.

The other half of the problem: no legitimate cross-org view exists either — no org list, no per-org usage. A platform operator has no sanctioned way to see the fleet, which is part of why the unscoped queries were not noticed.

Both halves need designing together: decide what a platform admin should see, build that deliberately, and scope everything else.

The `/admin` Users, Audit and Correlation views query without an `org_id` filter, so they return data across every org. `routers/users.py:57-70` lists all Firebase users fleet-wide and never shows which org a user belongs to. This is the same failure mode `SAAS_PLAN.md` flagged before the tenancy work, simply missed on the admin side during the `org_id` pass. It becomes a real leak the moment a second org exists. The other half of the problem: no legitimate cross-org view exists either — no org list, no per-org usage. A platform operator has no sanctioned way to see the fleet, which is part of why the unscoped queries were not noticed. Both halves need designing together: decide what a platform admin *should* see, build that deliberately, and scope everything else.
Author
Owner

Promoted to a hard revenue gate by board minutes #42 (2026-08-23) - this is Gate B condition B2.

No customer is charged until this is closed. The CISO (#39) ranked it below #13 on exploitability (platform-admin only, not customer-reachable) but flagged the real significance: routers/users.py:57-70 lists all Firebase users fleet-wide with no org indication, which means the platform side of tenancy was missed in the same pass that scoped the customer side. That makes it evidence the tenancy sweep was not exhaustive, which is why it is on the gate rather than in the general backlog.

Owner: CTO. Date: 2026-09-30.

**Promoted to a hard revenue gate by board minutes #42 (2026-08-23) - this is Gate B condition B2.** No customer is charged until this is closed. The CISO (#39) ranked it below #13 on exploitability (platform-admin only, not customer-reachable) but flagged the real significance: `routers/users.py:57-70` lists all Firebase users fleet-wide with no org indication, which means **the platform side of tenancy was missed in the same pass that scoped the customer side**. That makes it evidence the tenancy sweep was not exhaustive, which is why it is on the gate rather than in the general backlog. Owner: CTO. Date: **2026-09-30**.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: logan/server-26#4