Language: TypeScript
Label: vulnerable
CWE: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Code:
		super(meta, paramDef, async (ps, me) => {
			const user = await this.usersRepository.findOneBy({ id: ps.userId });

			if (user == null) {
				throw new Error('user not found');
			}
	
			if (user.avatarId == null) return;

			await this.usersRepository.update(user.id, {
				avatar: null,
				avatarId: null,
				avatarUrl: null,
				avatarBlurhash: null,
			});

			this.moderationLogService.log(me, 'unsetUserAvatar', {
				userId: user.id,
				userUsername: user.username,
				userHost: user.host,
				fileId: user.avatarId,
			});
		});