Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
Date: 2026-03
Affected: composer/grumpydictator/firefly-iii
Attack vector: phishing
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-863

### Summary The User management API endpoints (`GET /api/v1/users` and `GET /api/v1/users/{id}`) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. ### Affected Endpoints 1. **GET /api/v1/users** (UserController::index, line 94) — Lists ALL users with full details. No role check. 2. **GET /api/v1/users/{id}** (UserController::show, line 126) — Shows any user's details by ID. No role check. ### Root Cause (1-of-N Inconsistency) Other methods in the same controller properly check for the 'owner' role: - `store()` — `UserStoreRequest::authorize()` checks `auth()->user()->hasRole('owner')` ✓ - `destroy()` — Explicitly checks `$this->repository->hasRole($admin, 'owner')` ✓ But `index()` and `show()` have no role check at all. The route group at `routes/api.php:734-747` has no admin middleware, only the global `auth:api` middleware. ### Exposed Data The `UserTransformer` (line 40-54) returns: - `email` — user's email address - `role` — user's role (owner/demo) - `blocked` — account blocked status - `blocked_code` — block reason - `created_at` / `updated_at` — timestamps ### Impact Any authenticated user can: 1. Enumerate ALL user accounts in the instance 2. Harvest email addresses for phishing/social engineering 3. Identify admin/owner accounts by role 4. Determine which accounts are blocked ### Exploitation ```bash # List all users curl -H "Authorization: Bearer <any_user_toke


Mitigations:

Architectural layers (MAESTRO):