From ea23e9a5ba360ab77a16dfb8e48e5b2471fee8c4 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sat, 27 Jun 2026 07:53:38 -0700 Subject: users: return generic 404 from /reset for non-admins The admin-only password-reset endpoint returned "disabled" to non-admin callers, which confirmed both that the endpoint exists and that it is admin-gated. Return a generic 404 identical to an unregistered route instead; still log the rejected attempt server-side for monitoring. Co-Authored-By: Claude Opus 4.8 (1M context) --- routes/users.ts | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/routes/users.ts b/routes/users.ts index 3bf41355..572224be 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -759,7 +759,16 @@ export default { let id; let user; - if (u.username !== config.admin) fail("disabled"); + // Non-admins must not be able to tell this admin-only endpoint exists. + // Log the probe (so exploit-watch can flag it) but return a generic 404 + // identical to an unregistered route — previously it returned "disabled", + // which confirmed the endpoint AND its admin-gating to attackers. + if (u?.username !== config.admin) { + err("password reset failed disabled", req.headers["cf-connecting-ip"]); + return res + .code(404) + .send({ message: "Route POST:/reset not found", error: "Not Found", statusCode: 404 }); + } id = await g(`user:${username.toLowerCase().replace(/\s/g, "")}`); user = await g(`user:${id}`); -- cgit v1.2.3