GHSA-47wq-cj9q-wpmp: Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
Isolated paperclip instance running in authenticated mode (default config)
on a clean Docker image matching commit b649bd4 (2026.411.0-canary.8, post
the 2026.410.0 patch). This advisory was verified on an unmodified build.Summary`POST /api/agents/:id/keys`, `GET /api/agents/:id/keys`, and
`DELETE /api/agents/:id/keys/:keyId` (`server/src/routes/agents.ts`
lines 2050-2087) only call `assertBoard` to authorize the caller. They never
call `assertCompanyAccess` and never verify that the caller is a member of the
company that owns the target agent.Any authenticated board user (including a freshly signed-up account with zero
company memberships and no `instance_admin` role) can mint a plaintext
`pcp_*` agent API token for any agent in any company on the instance. The
minted token is bound to the **victim** agent's `companyId` server-side, so
every downstream `assertCompanyAccess` check on that token authorizes
operations inside the victim tenant.This is a pure authorization bypass on the core tenancy boundary. It is
distinct from GHSA-68qg-g8mg-6pr7 (the unauth import → RCE chain disclosed in
2026.410.0): that advisory fixed one handler, this report is a different
handler with the same class of mistake that the 2026.410.0 patch did not
cover.Root Cause`server/src/routes/agents.ts`, lines 2050-2087:Compare the handler 12 lines below, `router.post("/agents/:id/wakeup")`,
which shows the correct pattern: it fetches the agent, then calls
`assertCompanyAccess(req, agent.companyId)`. The three `/keys` handlers above
do not even fetch the agent.The token returned by `POST /agents/:id/keys` is bound to the **victim**
company in `server/src/services/agents.ts`, lines 580-609:`actorMiddleware` (`server/src/middleware/auth.ts`) then resolves the bearer
token to `actor = { type: "agent", companyId: existing.companyId }`, so every
subsequent `assertCompanyAccess(req, victim.companyId)` check passes.The exact same `assertBoard`-only pattern is also present on agent lifecycle
handlers in the same file (`POST /agents/:id/pause`, `/resume`, `/terminate`,
and `DELETE /agents/:id` at lines 1962, 1985, 2006, 2029). An attacker can
terminate, delete, or silently pause any agent in any company with the same
primitive.Trigger ConditionsPaperclip running in `authenticated` mode (the public, multi-user
configuration — `PAPERCLIP_DEPLOYMENT_MODE=authenticated`).`PAPERCLIP_AUTH_DISABLE_SIGN_UP` unset or false (the default — same
default precondition as GHSA-68qg-g8mg-6pr7).At least one other company exists on the instance with at least one
agent. In practice this is the normal state of any production paperclip
deployment. The attacker needs the victim agent's ID, which leaks through
activity feeds, heartbeat run APIs, and the sidebar-badges endpoint that
the 2026.410.0 disclosure also flagged as under-protected.No admin role, no invite, no email verification, no CSRF dance. The attacker
is an authenticated browser-session user with zero company memberships.PoCVerified against a freshly built `ghcr.io/paperclipai/paperclip:latest`
container at commit `b649bd4` (2026.411.0-canary.8, which is **post** the
2026.410.0 import-bypass patch). Full 5-step reproduction:Observed outputs (all verified on live instance at time of submission):`POST /api/agents/:id/keys` → **201** with plaintext `token` bound to
the victim's `companyId``GET /api/companies/:victimId` → **200** full company metadata`GET /api/companies/:victimId/issues` → **200** issue list`GET /api/companies/:victimId/agents` → **200** agent list`GET /api/companies/:victimId/approvals` → **200** approval listImpact**Type:** Broken access control / cross-tenant IDOR (CWE-285, CWE-639,
CWE-862, CWE-1220)**Who is impacted:** every paperclip instance running in `authenticated`
mode with default `PAPERCLIP_AUTH_DISABLE_SIGN_UP` (open signup). That is
the documented multi-user configuration and the default in
`docker/docker-compose.quickstart.yml`.**Confidentiality:** HIGH. Any signed-up user can read another tenant's
company metadata, issues, approvals, runs, and agent configuration (which
includes adapter URLs, model settings, and references to stored secret
bindings).**Integrity:** HIGH. The minted token is a persistent agent credential
that authenticates for every `assertCompanyAccess`-gated agent-scoped
mutation in the victim tenant (issue/run updates, self-wakeup with
attacker-controlled payloads, adapter execution via the agent's own
adapter, etc.).**Availability:** HIGH. The attacker can `pause`, `terminate`, or
`DELETE` any agent in any company via the sibling `assertBoard`-only
handlers (`/agents/:id/pause`, `/resume`, `/terminate`,
`DELETE /agents/:id`).**Relation to GHSA-68qg-g8mg-6pr7:** the 2026.410.0 patch added
`assertInstanceAdmin` on `POST /companies/import` and closed the disclosed
chain, but the same root cause (`assertBoard` treated as sufficient where
`assertCompanyAccess` is required on a cross-tenant resource, or where
`assertInstanceAdmin` is required on an instance-global resource) is
present in multiple other handlers. The import fix did not audit sibling
routes. This report is an instance of that same class the prior advisory
did not cover.Severity is driven by the fact that every precondition is default, the bug
is reachable by any signed-up user with zero memberships, and the stolen
token persists across sessions until manually revoked.Suggested FixIn `server/src/routes/agents.ts`, replace each of the three `/keys` handlers
so they load the target agent first and enforce company access:While fixing this, audit the sibling lifecycle handlers at lines 1962-2048
(`/agents/:id/pause`, `/resume`, `/terminate`, `DELETE /agents/:id`) which
share the same bug.Defense in depth: consider a code-wide sweep for `assertBoard(req)` calls
that are not immediately followed by `assertCompanyAccess` or
`assertInstanceAdmin` — the 2026.410.0 patch focused on one handler but the
pattern is systemic.Patch StatusLatest image at time of writing: `ghcr.io/paperclipai/paperclip:latest`
digest `sha256:baa9926e...`, commit `b649bd4`
(`canary/v2026.411.0-canary.8`), which is *after* the 2026.410.0 import
bypass fix.The bug is still present on that revision. PoC reproduced end-to-end
against an unmodified container.CreditsDiscovered by [pwnkit](https://github.com/peaktwilight/pwnkit), an
AI-assisted security scanner, during variant-hunt analysis of
GHSA-68qg-g8mg-6pr7. Manually verified against a live isolated paperclip
instance.
CVSS v3.1: 9.9