[Security] IDOR: Any Authenticated User Can Delete Any Post or Comment

[abdurazzoqovjavohir700-dev]

Security Vulnerability Report: IDOR — Unauthorized Post & Comment Deletion

Hello @DogukanUrker,

I'm a security researcher and found an IDOR (Insecure Direct Object Reference) vulnerability in FlaskBlog.

Vulnerability Summary

Severity: High (CVSS 8.1)
Type: IDOR — Missing Authorization Check (CWE-639)

Affected Files

• app/routes/post.py lines 45–51

Description

In post.py, the /post/<url_id> route handles POST requests with post_delete_button and comment_delete_button fields. There is no check that the currently logged-in user is the author of the post/comment before deleting it.

# post.py — MISSING ownership check
if "post_delete_button" in request.form:
    delete_post(post.id)   # any logged-in user can delete any post!
    return redirect("/")

Compare with the correct check in dashboard.py:

# dashboard.py — CORRECT
if session["username"].lower() == username.lower():
    if "post_delete_button" in request.form:
        delete_post(request.form["post_id"])

Proof of Concept

Any authenticated user can delete any other user's post:

POST /post/<any_url_id>
Cookie: session=<attacker_session>
Content-Type: application/x-www-form-urlencoded

post_delete_button=1

Fix

if "post_delete_button" in request.form:
    if post.author != session.get("username") and session.get("user_role") != "admin":
        abort(403)
    delete_post(post.id)
    return redirect("/")

Same fix needed for comment_delete_button — check comment.username == session["username"] before deleting.

---

Reported by: Javohir Abdurazzoqov (security researcher)

[DogukanUrker]

🤖 AI-generated implementation plan — local LLM (ornith-35b) via Hermes Agent.
Not human-reviewed. Do NOT merge or act on this without human approval.

Problem

IDOR vulnerability in post/comment deletion allowing any authenticated user to delete any post or comment (CWE-639).

Current state in main

ALREADY FIXED. The authorization checks are implemented in app/utils/delete.py:

• delete_post(post_id, username) (line 24): Checks is_admin and is_author before deletion
• delete_comment(comment_id, username) (line 103): Same authorization logic

Both functions return False if user is not authorized, preventing unauthorized deletion.

Root cause

The original code in app/routes/post.py (lines 52, 57) called delete_post() and delete_comment() without verifying ownership. The fix moved authorization checks into the utility functions themselves.

Proposed fix

No changes needed. The fix was applied in commit cee3543 (PR #252):

# app/utils/delete.py:41-49
user = User.query.filter_by(username=username).first() if username else None
is_admin = user and user.role == "admin"
is_author = username and post.author.lower() == username.lower()

if not is_admin and not is_author:
    Log.error(...)
    return False

Files to change

None — already fixed.

Test plan

• Verify existing tests cover authorization checks
• Add test: non-author user attempts to delete post → returns False
• Add test: non-author user attempts to delete comment → returns False
• Add test: admin user can delete any post/comment → returns True

Risks & edge cases

• Session username mismatch with database username
• Race conditions during concurrent deletion
• Admin account deletion (last admin)

Out of scope

• Dashboard deletion (separate issue)
• Admin panel authorization (separate issue)

Status: Issue #254 is already resolved in current main.