[Bug] Org Scan Result Endpoints Missing Authentication — Data Exfiltration Path

[ionfwsrijan]

Description

Org scan creation requires an API key, but all result-access endpoints (findings, summary, PDF report, blast radius, abort, SSE stream) lack authentication. The security model says "you must authenticate to start a scan" but then "anyone can read all results." If the org_job_id UUID is leaked through any vector, an unauthenticated attacker can access the complete vulnerability posture of the entire organization.

Actual Behavior

backend/app/main.py:

POST /api/scans/org              → HAS auth (line 1655)
GET  /api/scans/org/{id}/status  → HAS auth (line 1691)
POST /api/scans/org/{id}/abort   → NO auth (line 1724)
GET  /api/scans/org/{id}/stream  → NO auth (line 1761)
GET  /api/scans/org/{id}/summary → NO auth (line 1808)
GET  /api/scans/org/{id}/findings → NO auth (line 1867)
GET  /api/scans/org/{id}/report/pdf → NO auth (line 1904)
GET  /api/scans/org/{id}/blast-radius → NO auth (line 2012)

The org_job_id is a UUID (uuid.uuid4() at main.py line 1671), which is not guessable. However, it leaks through:

• SSE stream URL (visible in browser network tab)
• Referrer headers
• Shared links between team members
• Frontend localStorage (patchpilot:lastScan)

Impact

An unauthenticated attacker who obtains the UUID can:

• Access ALL findings for EVERY repository in the organization
• Download the full PDF audit report
• View the dependency blast radius graph
• Abort running scans (denial of service)
• Access real-time scan progress via SSE stream

Expected Behavior

All org scan result endpoints must require the same authentication as the creation endpoint.

Proposed Fix

1. main.py: Add Depends(verify_api_key) to all org scan result endpoints (abort, stream, summary, findings, report/pdf, blast-radius)
2. Alternatively, implement a scoped token issued at scan creation time that grants read access to that specific scan's results
3. api.ts: Update the frontend to send auth headers with these requests (once Issue Persist findings to SQLite on every scan completion #2 is resolved)

[github-actions]

👋 Welcome @ionfwsrijan!

Thank you for opening an issue and contributing to Patchpilot. 🚀

Next Steps

• Please ensure you've provided all the required details.
• A maintainer will review your issue shortly.
• Feel free to ask questions if anything is unclear.

⚡ Want faster assignment and quicker responses?

Join our Discord community:

🔗 https://discord.gg/FcXuyw2Rs

We actively discuss issues, features, roadmap updates, and contributor support there.

Happy Contributing! 🎉

[saidai-bhuvanesh]

claim

[KolaSailaja]

@ionfwsrijan Could you please assign me this issue i am interested to work on

[github-actions]

⚠️ Assignment Notice

Hi @KolaSailaja! 👋

It looks like you currently have 4 open assigned issues.

To ensure fair distribution of work and timely progress, we encourage contributors to complete or unassign their existing issues before taking on additional ones.

📋 Current Assigned Issues

• [Bug] Org Scan Result Endpoints Missing Authentication — Data Exfiltration Path #322 — [Bug] Org Scan Result Endpoints Missing Authentication — Data Exfiltration Path
• [ML] Attack Path Correlation & Visualization for Security Findings #145 — [ML] Attack Path Correlation & Visualization for Security Findings
• [ML] AI-Powered Root Cause Grouping for Security Findings #144 — [ML] AI-Powered Root Cause Grouping for Security Findings
• [Feature] Security Policy Engine for Custom Compliance Enforcement #140 — [Feature] Security Policy Engine for Custom Compliance Enforcement

If you're actively working on them, feel free to continue. Otherwise, please consider freeing up an issue for other contributors.

Note: This is only a friendly reminder. Your assignment has not been removed.

Thank you for contributing to PatchPilot! 🚀

[jagritiuppal158]

Hi @ionfwsrijan can i work on this issue?