ccfos/nightingale

Improper Access Control Vulnerability

Open

#2,868 opened on Sep 5, 2025

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Go (1,720 forks)github user discovery
help wanted

Repository metrics

Stars
 (13,061 stars)
PR merge metrics
 (PR metrics pending)

Description

Question and Steps to reproduce

夜莺的角色权限管理对于数据查询似乎只在前端做了控制，未对后端API进行权限控制。 复现过程： 1.在角色管理界面，调整标准用户权限，只保留仪表盘查看功能。

2.登录该角色的普通用户账户，数据查询处，“指标”和“日志”功能菜单已消失。

3.使用url路径直接访问指标查询/metric/explorer，会报403，逻辑正常。

4.但此时，用户通过“告警-历史告警”功能处，随便点击任一历史告警，查看告警详情，点击PromQL查询按钮，可成功跳转到指标查询页面。

5.此时可任意执行数据查询命令，不再会被拦截。

6.按F12调试可知，应该是 /api/n9e/proxy/1/api/v1/query_range /api/n9e/proxy/1/api/v1/query 接口未同步进行权限控制。

修改建议： 1.后端数据查询的API接口也增加角色鉴权？

其他建议： 除了菜单权限控制，是否考虑做数据源权限控制？一个平台接入多个数据源，希望实现查询界面的数据源可进行单独授权，A数据源授权给A用户，B数据源授权给B团队。

Relevant logs and configurations

以上

Version

n9e : v8.3.1 linux: centos7.9 docker: 26.1.4

Contributor guide

Research direction
Inspect the proxy API routes (e.g., /api/n9e/proxy) and ensure authentication/authorization middleware is applied to all backend data query endpoints, especially those reachable via workarounds like alert details. Verify the permission checks are not only frontend based.
Tech stack
go
Domain
backendsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoWeb security basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40