[MEDIUM] M5: Production manifest read leaks permissions block and schema layout to any authenticated NC user

[rubenvdlinde]

Severity: MEDIUM

Location: lib/Controller/ApplicationsController.php:156-235 (getManifest, no ?_version= parameter)

Description:
The production-manifest endpoint is annotated #[NoAdminRequired] and explicitly bypasses RBAC ("accessible to every authenticated caller — Decision 2"). The manifest payload includes:

• permissions.owners — reveals who owns the app and their group memberships
• register and schema slugs — reveals the OR data-model structure
• Full page/widget/menu configuration

Any internal Nextcloud user with no role on a private application can GET /api/applications/{any-slug}/manifest and read the complete structural metadata of every published app — including competitor-internal apps if multiple tenants share the same Nextcloud instance.

The intent (per Decision 2) was "production manifests are public to authenticated users so any user can run an app". The side-effect is that permissions (ownership PII + group memberships) leaks alongside rendering-necessary fields.

Suggested fix:

• Filter the permissions block from the public production-manifest response; only return it to owners/editors.
• Long-term: make public-manifest access per-Application opt-in (a "published" flag), so private-but-deployed apps don't expose their structure to the whole instance.

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in PR #174 (RBAC/audit completeness — admin-merged 2026-05-27). See PR for the addressed scope.