[HIGH] H1: App/version Register creation bypasses OR checkRegisterManagePermission

[rubenvdlinde]

Severity: HIGH

Location: lib/Controller/ApplicationsController.php:1301 (findOrCreateRegister), lib/Service/ApplicationCreationService.php (per-version register creation)

Description:
Register creation during createApp / createFromTemplate calls $this->registerMapper->createFromArray([...]) directly. OR's checkRegisterManagePermission (default-secure, admin-only-create per OR #1949) is bypassed. Any authenticated user can mint OR Registers via these code paths even if an NC admin has revoked register-create privileges in OpenRegister.

OpenBuilt becomes a backdoor around OR's data-platform RBAC — a user denied Register creation in OR's admin panel can regain it by calling createApp through openbuilt.

Suggested fix:

• Route register creation through RegistersController (or a shared service that replicates checkRegisterManagePermission).
• Alternatively, run openbuilt's app-creation only under a service account with explicit register-create rights, and document that elevated permission requirement clearly.

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in PR #174 (RBAC/audit completeness — admin-merged 2026-05-27). See PR for the addressed scope.