[CRITICAL] Authentication Bypass: Saved Views Router Missing API Key Enforcement

[namann5]

Vulnerability Summary

Severity: CRITICAL
Type: Authentication Bypass
CVSS Score: ~9.1

Description

The saved_views_router in backend/secuscan/saved_views.py is registered in main.py without the require_api_key dependency, allowing unauthenticated access to all saved views endpoints.

Affected Endpoints

• GET /api/v1/saved-views — Lists all saved views (unauthenticated)
• POST /api/v1/saved-views — Creates views (unauthenticated)
• PUT /api/v1/saved-views/{view_id} — Modifies views (unauthenticated)
• DELETE /api/v1/saved-views/{view_id} — Deletes views (unauthenticated)

Vulnerable Code

File: backend/secuscan/saved_views.py:12

saved_views_router = APIRouter(prefix="/api/v1/saved-views", tags=["saved-views"])

Comparison — Protected Router in routes.py:133:

router = APIRouter(prefix="/api/v1", dependencies=[Depends(require_api_key)])

Registration in main.py:294:

app.include_router(saved_views_router)  # NO authentication dependency

Impact

1. Data Exposure: Any unauthenticated client can enumerate all saved filter configurations, potentially revealing sensitive monitoring targets and scan scope.
2. Data Tampering: Attackers can create, modify, or delete saved views to disrupt security operations.
3. Stored XSS Vector: The filter_json field is consumed by frontend components without sanitization — malicious JSON could trigger XSS.
4. No Owner Scoping: The saved_views table has no owner_id column, meaning even authenticated users can access other workspaces' views (data isolation failure).

Suggested Fix

Add the require_api_key dependency to the router and add owner scoping:

from .auth import require_api_key, get_current_owner

saved_views_router = APIRouter(
    prefix="/api/v1/saved-views",
    tags=["saved-views"],
    dependencies=[Depends(require_api_key)],
)

Steps to Reproduce

1. Start the application
2. Send curl http://localhost:8000/api/v1/saved-views without any API key header
3. Observe that all saved views are returned without authentication