@cryptotaxi247 / CoPilot / commits / 3173fc8e

fix(security): restrict GET /api/connectors/{id} to admin only (GHSA-c5pw-2h98-r798) (#887)

The per-ID connector endpoint returned plaintext connector_password and connector_api_key in its ConnectorResponse body but was gated with require_any_scope("admin", "analyst"). Any analyst-role user could therefore enumerate connector IDs and extract the deployment-wide root credentials for every integrated tool (Wazuh, Graylog, Velociraptor, Grafana, ...). Change the dependency to require_any_scope("admin"), aligning it with the already-admin-only list endpoint (GET /api/connectors). The verify endpoint is left unchanged since VerifyConnectorResponse returns no secrets. This closes the API-level disclosure (CWE-200 / CWE-863). Plaintext storage at rest (CWE-256) is tracked separately. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

taylor_socfortress committed May 27, 2026 at 14:14 UTC 3173fc8e71dc589a6904da60047498d059992d5e

1 file changed +4 -1

backend/app/connectors/routes.py

+4 -1

@@ -58,7 +58,10 @@ async def get_connectors(

58 "/{connector_id}",

59 response_model=ConnectorListResponse,

60 description="Fetch a specific connector",

61 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

61 + # Admin-only: this response includes plaintext connector_password / connector_api_key,

62 + # so it must match the admin-only list endpoint above and must not be reachable by the

63 + # analyst role. See GHSA-c5pw-2h98-r798.

64 + dependencies=[Security(AuthHandler().require_any_scope("admin"))],

65 )

66 async def get_connector(

67 connector_id: int,