SEC: Agent Subscription Management by Shared Users (BOLA)

[vybe]

Pentest Finding 3.2.5 — Medium (CVSS 4.8)

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Location: PUT /api/subscriptions/agents/{name}, DELETE /api/subscriptions/agents/{name} — routers/subscriptions.py lines 184, 218

Impact

A user with shared read access to an agent can:

• Assign any subscription (Claude API OAuth token) to that agent
• Clear its subscription assignment
• Both operations trigger a container restart

This enables hot-swapping Claude credentials, DoS by clearing the subscription, and cross-account subscription abuse (unexpected billing/rate-limit consumption).

Root Cause

routers/subscriptions.py line 184 uses the permissive can_user_access_agent check (owners + admins + shared users) instead of can_user_share_agent (owners + admins only). The endpoint docstring states "Owner access required" but the implementation enforces only "any access". Same issue at line 218 for DELETE.

Remediation

• Replace db.can_user_access_agent with db.can_user_share_agent (owner/admin only) in both PUT and DELETE handlers
• Audit all other mutation endpoints for the same authorization predicate confusion
• Add test asserting non-owner shared users receive HTTP 403 on subscription mutation endpoints

References

• OWASP API: Broken Object Property Level Authorization

Source: UnderDefense Web Pentest Report, March 2026

[vybe]

Fixed in a2c4012. Replaced can_user_access_agent with can_user_share_agent in both PUT and DELETE /api/subscriptions/agents/{name} handlers. Shared users now get HTTP 403 on subscription mutation — only owners and admins can assign/clear subscriptions. Read-only auth status endpoint unchanged. 7 unit tests added.