T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skills/smyx_common/scripts/util.py:426- Finding
Shared Fallback Identity Enables Cross-User Access to Sensitive Psychological Reports
- Content
View full analysis
Vulnerability Details
File Location:
skills/smyx_common/scripts/util.py:426-455
Vulnerability Type: Improper user isolation through a workspace-wide fallback identity
Risk Level: HighRelevant supporting locations:
skills/smyx_common/scripts/util.py:389-400scripts/psychology_analysis.py:175-181skills/smyx_analysis/scripts/skill.py:140-166skills/smyx_common/scripts/dao.py:482-498
Vulnerable code:
python @classmethod def get_or_create_default_open_id(cls): from .dao import UserDao, User import uuid user_dao = UserDao() user = user_dao.get_first_default_user( cls.DEFAULT_PREFIX, cls.DEFAULT_USERNAME_LENGTH ) if user and user.username: return user.username for _ in range(10): username = cls.generate_default_open_id() if user_dao.get_by_username(username): continue now = datetime.now() user = User( id=uuid.uuid4().hex, username=username, realname=username, source=ConstantEnum.APP__SOURCE, del_flag=0, create_time=now, update_time=now ) user_dao.add(user) return username raise RuntimeError("Failed to generate a default open-id")python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): resolved_open_id = ( (open_id or "").strip() if isinstance(open_id, str) else open_id ) if not resolved_open_id and use_current: resolved_open_id = ( ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME ) if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnu ...[truncated 3999 chars]- Remediation
View remediation
Remediation Suggestions
- Require a verified, per-request upstream sender identity for all analysis and historical-report operations in multi-user deployments.
- Fail closed when a trustworthy sender identity is unavailable instead of silently selecting the first fallback database account.
- Scope fallback identities to a single authenticated user or isolated single-user installation; never share one fallback identity across unrelated callers.
- Bind cached API tokens to both the authenticated sender and tenant. Do not retrieve tokens solely by a workspace-global default username.
- Pass the authenticated identity through the entire call chain and enforce report ownership on the server for listing, result retrieval, and export endpoints.
- Do not rely on hidden CLI arguments as an authorization mechanism. Accept identity only from a trusted integration channel and reject user-controlled identity overrides.
- Add explicit tests covering two different users in the same workspace and verify that neither can list, retrieve, or export the other user’s reports.
- Migrate existing shared fallback data into separately owned accounts or require affected users to reauthenticate before historical reports can be accessed.