CRITICAL: Unauthenticated CRUD on persistent user database - zero auth on entire /userdb/ router

[Galaxync]

Summary

The entire users_db router exposes create, read, update, and delete operations against the persistent MongoDB users collection with no authentication or authorization dependency on any endpoint. There is no ownership check, no admin privilege check, and no identity requirement.

Location

• Backend/FastAPI/routers/users_db.py:32-67

Vulnerable Endpoints

• GET /userdb/ - list all users (no auth)
• GET /userdb/{id} - get specific user (no auth)
• POST /userdb/ - create user (no auth)
• PUT /userdb/ - full replace of any user by ObjectId (no auth)
• DELETE /userdb/{id} - delete any user (no auth)

CWE

CWE-306 (Missing Authentication), CWE-639 (IDOR), CWE-269 (Privilege Escalation)

Exploitation

1. Enumerate users: GET /userdb/ returns every user's id, username, and email with zero credentials
2. Modify victim's record: PUT /userdb/ with body {"id":"<victim_objectid>","username":"hijacked","email":"attacker@evil.com"} - the victim's document is entirely replaced
3. Delete victim account: DELETE /userdb/<victim_id> - permanently deletes the user from MongoDB
4. Create backdoor accounts: POST /userdb/ with any arbitrary user data

Impact

Complete compromise of all user account data. An attacker can enumerate, modify, delete, or create user records at will. This directly enables account takeover, privilege escalation, and permanent denial of service against legitimate users.

Note: The codebase includes separate authentication routers (�asic_auth_users, jwt_auth_users) confirming the intent to protect user data, yet none of that protection is wired into this router.