Security: Team membership modification authorized as create operation (HIGH)

[akaiwen]

Summary

Security audit of LavaLite CMS identified an authorization flaw in the Team module.

Custom team membership endpoints modify an existing team, but they are authorized as create operations instead of update operations on the target team.

Finding

HIGH: Authorization Bypass in Team Attach/Detach Endpoints

Files:
Litepie/Team/routes/routes.php:12-13
Litepie/Team/Http/Requests/TeamResourceRequest.php:28-35
Litepie/Team/Http/Controllers/TeamResourceController.php:223-257
Litepie/Team/Actions/TeamAction.php:82-97

Routes:

• POST /{guard}/team/team/attach/{team}
• POST /{guard}/team/team/detach/{team}
• POST /api/{guard}/team/team/attach/{team}
• POST /api/{guard}/team/team/detach/{team}

The request authorizer treats any POST request as a store/create action:

if ($this->isCreate() || $this->isStore()) {
    return $this->can('create');
}

Because attach and detach are implemented as POST, they are authorized with create permission even though they modify an existing Team.

The action then directly updates membership:

public function attach(Team $team, array $data)
{
    $this->detach($team, $data);
    $team->users()->attach($data['user_id'], ['level' => $data['level']]);
    return $team;
}

Impact

An authenticated low-privileged user with team.team.create, but without ownership or edit permission on the target team, can:

• add itself to an existing team
• add another user to an existing team
• remove users from an existing team

This can break any access control or workflow logic that relies on trusted team membership.

Verification

Verified locally on v10.1.0:

• authenticated as a low-privileged user
• granted only team.team.create
• sent POST /api/user/team/team/attach/{team_hashid}
• server accepted the request
• a new team_user record was created for the target team

Recommended Fix

• Authorize attach and detach as update operations on the target Team
• Do not treat custom POST actions on existing resources as generic store/create requests
• Add explicit permission checks in the controller or request class for membership-management actions