security: API profiles endpoint leaks FTP/S3/GDrive credentials #78

New Issue

2026-06-21T23:01:35Z

jmiller commented

2026-06-21 23:01:35 +00:00

Severity: HIGH

api/BackupsController::profiles() returns the entire profile object including ftp_password, s3_secret_key, gdrive_client_secret, gdrive_refresh_token, and encryption_password in the JSON API response.

Any authenticated API consumer with core.manage can read all stored credentials.

Fix

Unset sensitive fields before serialization, or create a sanitized DTO with only safe fields.

File

api/src/Controller/BackupsController.php:124-130

## Severity: HIGH `api/BackupsController::profiles()` returns the entire profile object including `ftp_password`, `s3_secret_key`, `gdrive_client_secret`, `gdrive_refresh_token`, and `encryption_password` in the JSON API response. Any authenticated API consumer with `core.manage` can read all stored credentials. ## Fix Unset sensitive fields before serialization, or create a sanitized DTO with only safe fields. ## File - `api/src/Controller/BackupsController.php:124-130`

jmiller added the component: api label 2026-06-21 23:01:35 +00:00

jmiller referenced this issue

2026-06-21 23:04:13 +00:00

test: Deep dive audit — verify and fix all findings #81

jmiller referenced this issue from a commit

2026-06-21 23:09:43 +00:00

fix: critical and high audit findings (#81)

jmiller referenced a pull request that will close this issue

2026-06-21 23:09:56 +00:00

fix: Critical and high audit findings (#81) #83

jmiller closed this issue

2026-06-21 23:10:23 +00:00