Security Flaw: Privilege Escalation in Nebula API

henriquev · February 3

Hello,

We have identified that a user with "read-only" permissions can perform write actions, such as creating a new site within our organization, by using an API key (created by the user in his account). This same action is correctly blocked in the user interface (UI).

This loophole allows for improper privilege escalation and violates the principle of least privilege, creating a security risk for our organization. I have not yet tested with other API calls like register devices and moving devices between sites.

Could you please inform us if there are any controls to mitigate this? Are there plans (a roadmap) to align API permissions with UI permissions, thereby restricting read-only users to GET calls?