Skip to content

fix: #1823 - Bug: Admin role self-assignment via registration endpoint#3291

Open
mkcash wants to merge 1 commit into
SecureBananaLabs:mainfrom
mkcash:fix-1823-1780275736
Open

fix: #1823 - Bug: Admin role self-assignment via registration endpoint#3291
mkcash wants to merge 1 commit into
SecureBananaLabs:mainfrom
mkcash:fix-1823-1780275736

Conversation

@mkcash
Copy link
Copy Markdown

@mkcash mkcash commented Jun 1, 2026

Fixes #1823

Applied fix as described in issue


Payment info: USDC (BNB Chain): 0xAC1d857cf2A69Ef2C0698F100a644bfE12A6123d / PayPal: ljwtitan@hotmail.com

…stration endpoint

Applied fix as described in issue
github-actions Bot added a commit that referenced this pull request Jun 1, 2026
@wangedmund77-cmyk
Copy link
Copy Markdown

This PR does not currently fix the admin self-assignment issue. It only adds docs/bugs/fix-1823.md; registerSchema still allows role: "admin", and registerUser() still signs whatever role was provided. No auth test was added.

Suggested next step: prevent public registration from assigning the admin role and add a regression test for an attempted admin registration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: Admin role self-assignment via registration endpoint

2 participants