T05 · Unauthorized Access and Privilege Escalation
Error
- Location
mcp_api.py:68- Finding
Unauthenticated Access to Sensitive Negotiation Sessions
- Content
View full analysis
dict: if session_id not in sessions: raise ValueError(f"Session '{session_id}' not found. Call create_session first.") return sessions[session_id] ``` ```python @mcp.tool() def create_session() -> str: """Create a new negotiation coaching session. Returns a session_id to use with all other tools. Call this first.""" session_id = str(uuid.uuid4())[:8] sessions[session_id] = { "issues": [], "elicitation_choices": [], "learned_weights": {}, "counterpart_weights": {}, "batna": None, "batna_score": 0, "last_offers": [], "negotiation_round": 0, } return json.dumps({"session_id": session_id, "status": "created"}) @mcp.tool() def add_issue(session_id: str, issue_name: str, options: list[str]) -> str: """Add a negotiable issue/term to the session. Options ordered WORST to BEST for the user (e.g., ['$150K', '$160K', '$170K', '$180K']).""" session = _get_session(session_id) for existing in session["issues"]: if existing["name"].lower() == issue_name.lower(): existing["options"] = options return json.dumps({"status": "updated", "issue": issue_name, "total_issues": len(session["issues"])}) session["issues"].append({"name": issue_name, "options": options}) return json.dumps({"status": "added", "issue": issue_name, "total_issues": len(session["issues"])}) ``` ```python @mcp.tool() def get_negotiation_state(session_id: str) -> str: """Get current state of the negotiation model — issues, weights, BATNA, frontier size, and what to do next.""" session = _get_session(session_id) case ...[truncated 4114 chars]- Remediation
View remediation