bigcapital

mirror of https://github.com/bigcapitalhq/bigcapital.git synced 2026-06-01 15:39:00 +00:00

Files

Ahmed Bouhuolia 7efac090a9 fix(server): prevent cross-tenant access via organization-id header

Resolve a CLS middleware in App.module.ts to copy the request
`organization-id` header straight into `cls.organizationId`, which the
TenancyDB factory used to pick the per-tenant database. The JWT path
never set `organizationId` from the authenticated user, and
TenancyGlobalGuard only checked that the header was present — so any
authenticated user could read or write another tenant's database by
sending their own JWT plus the victim's `organization-id`.

Make the JWT-resolved tenant the source of truth and validate the
header at the edge:

- AuthSigninService.verifyPayload now loads the user's tenant and sets
  `cls.organizationId` from `tenant.organizationId`, mirroring the
  API-key path in AuthApiKeyAuthorizeService.
- TenancyGlobalGuard rejects with `Organization mismatch.` when the
  request header disagrees with the CLS value set by the auth guard.
- App.module.ts no longer seeds `cls.organizationId` from the
  attacker-controlled request header.

GHSA-2g96-86rw-qmvg

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-15 20:43:14 +02:00

api-key

feat: use the same Authorization header for jwt and api key

2025-07-02 08:30:53 +02:00

commands

fix(server): prevent cross-tenant access via organization-id header

2026-05-15 20:43:14 +02:00

dtos

feat(sdk-ts): add authentication fetch utils

2026-03-05 19:50:38 +02:00

exceptions

fix: auth pages errors handler