From 83382ee251d02ca67a673661809ab14e7b495624 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Tue, 3 Feb 2026 18:44:55 +0000 Subject: [PATCH] security: enforce scope checks on admin diagnostics endpoint --- internal/api/router.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/api/router.go b/internal/api/router.go index f379b02c2..6ce3562fc 100644 --- a/internal/api/router.go +++ b/internal/api/router.go @@ -314,7 +314,7 @@ func (r *Router) setupRoutes() { r.mux.HandleFunc("/api/charts", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleCharts))) r.mux.HandleFunc("/api/metrics-store/stats", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleMetricsStoreStats))) r.mux.HandleFunc("/api/metrics-store/history", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleMetricsHistory))) - r.mux.HandleFunc("/api/diagnostics", RequireAdmin(r.config, r.handleDiagnostics)) + r.mux.HandleFunc("/api/diagnostics", RequireAdmin(r.config, RequireScope(config.ScopeSettingsRead, r.handleDiagnostics))) r.mux.HandleFunc("/api/diagnostics/docker/prepare-token", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, r.handleDiagnosticsDockerPrepareToken))) r.mux.HandleFunc("/api/install/install-docker.sh", r.handleDownloadDockerInstallerScript) r.mux.HandleFunc("/api/install/install.sh", r.handleDownloadUnifiedInstallScript)