T05 · Unauthorized Access and Privilege Escalation
Error
- Location
app/api/server.py:59- Finding
Unauthenticated Network-Accessible Tenant Administration API
- Content
View full analysis
/users", methods=["POST"]) def create_user(provider: str): provider = normalize_provider(provider) payload = request.get_json(force=True) or {} identifier = payload.get("identifier") if not identifier: return failure("Missing identifier", 400) product = payload.get("product") options = payload.get("options") or {} result = user_service.create_user(provider, identifier, product=product, **options) return success(result, 201) @app.route("/api//users//assign", methods=["POST"]) def assign_product(provider: str, identifier: str): provider = normalize_provider(provider) payload = request.get_json(force=True) or {} product = payload.get("product") if not product: return failure("Missing product", 400) result = user_service.assign_product(provider, identifier, product) return success(result) @app.route("/api//users//password", methods=["POST"]) def reset_password(provider: str, identifier: str): provider = normalize_provider(provider) payload = request.get_json(force=True) or {} result = user_service.reset_password( provider, identifier, new_password=payload.get("new_password"), force_change_password=payload.get("force_change_password", True), ) return success(result) @app.route("/api//users/", methods=["DELETE"]) def delete_user(provider: str, identifier: str): provider = normalize_provider(provider) result = user_service.delete_user(provider, identifier) return success(result) @app.route("/api//users/", methods=["GET"]) def describe_user(provider ...[truncated 2539 chars]- Remediation
View remediation