[bug] updateCard does not verify that linkIds belong to the current user — IDOR vulnerability

[MehtabSandhu11]

In apps/backend/src/routes/cards.ts, the PUT /:id endpoint accepts linkIds and creates CardLink records without verifying that the provided platformLinkId values belong to the authenticated user:

await app.prisma.cardLink.createMany({
  data: parsed.data.linkIds.map((linkId, index) => ({
    cardId: id,
    platformLinkId: linkId, // ← never verified this belongs to userId
    displayOrder: index,
  })),
});

An attacker who knows another user's platformLinkId UUID can add that user's links to their own card, effectively stealing their profile link data.

Proposed fix

Before creating CardLinks, verify all provided linkIds belong to the current user:

const validLinks = await app.prisma.platformLink.findMany({
  where: { id: { in: parsed.data.linkIds }, userId },
});
if (validLinks.length !== parsed.data.linkIds.length) {
  return reply.status(403).send({ error: 'One or more links do not belong to you' });
}

Files to touch

• apps/backend/src/routes/cards.ts

---

GSSoC 2026 — Assignment Request

I would like to work on this issue as part of GirlScript Summer of Code 2026 (GSSoC'26). I have reviewed the codebase and understand the root cause and the fix required.

Could you please assign this issue to me?

GitHub: @MehtabSandhu11

Thank you!

[Midoriya-w]

Hey @ShantKhatri! I'd love to work on this under GSSoC 2026.
The fix is clear before creating CardLink records in cards.ts, query platformLink to verify all provided linkIds belong to the authenticated userId. If any don't match, return 403.

const validLinks = await app.prisma.platformLink.findMany({
where: { id: { in: parsed.data.linkIds }, userId },
});
if (validLinks.length !== parsed.data.linkIds.length) {
return reply.status(403).send({ error: 'One or more links do not belong to you' });
}

I'll also add a test case verifying the 403 response when a foreign linkId is used. Can I get assigned?

[Midoriya-w]

Hey @ShantKhatri! I've opened a PR with the fix verifies all linkIds belong to the authenticated user before creating CardLink records, returns 403 if any foreign ID is detected. Ready for review!

[MehtabSandhu11]

@Midoriya-w Dude! atleast wait for assignment. Can you not see I am doing the same?

[Midoriya-w]

Hey @MehtabSandhu11! Sorry for the overlap I saw the issue was unassigned and had the fix ready so I went ahead. No disrespect intended. @ShantKhatri can decide who to go with happy to collaborate if needed!

[Harxhit]

@MehtabSandhu11 I have assigned this issue to you.