PST-066: Any administrator may fetch any account's profile picture #795

New issue

Closed

opened 2026-10-10 10:56:37 +00:00 by tiagoagueda · 1 comment

tiagoagueda commented

2026-10-10 10:56:37 +00:00

Owner

Found in the security audit of 2026-10-10 (SECURITY-AUDIT-2026-10-10.md), run against main at c30851b from 8 to 10 October 2026, as PST-066. Severity: Informational.

The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it.

Severity: Informational
Category: administrator visibility (by design)
Location: src/postulo/accounts/views.py (343-366)
Found by: ownership review of accounts

Who can do it, and what they need. A staff user. No precondition beyond is_staff.

How it works.

GET /accounts/avatar/<any user pk>/ as a staff user returns that person's uploaded or Gravatar picture; the sweep (tests/security/test_isolation_sweep.py 'accounts:avatar') proves a member gets 404, and the People page draws each person's picture (#310), so this is the intended administrator view of account metadata. The CV photo kind is never served here.

Impact. None beyond what the threat model already grants administrators ('shows administrators accounts'). Recorded so the synthesis knows the staff branch exists and is deliberate.

Verification (verdict: confirmed; severity after verification: Informational). No change. It is a by-design administrator capability: accounts, including a person's profile picture, are visible to staff, who are trusted with the instance. A 404 for non-staff and a redirect to sign-in for anonymous visitors are confirmed. It is worth one line in the threat model that administrators can also fetch profile pictures.

Suggested remediation. No change needed. If the project ever wants administrators to see only the account list without faces, drop the is_staff branch and have the People page fall back to initials.

Found in the security audit of 2026-10-10 (`SECURITY-AUDIT-2026-10-10.md`), run against `main` at `c30851b` from 8 to 10 October 2026, as **PST-066**. Severity: **Informational**. The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it. --- - **Severity:** Informational - **Category:** administrator visibility (by design) - **Location:** `src/postulo/accounts/views.py` (343-366) - **Found by:** ownership review of accounts **Who can do it, and what they need.** A staff user. No precondition beyond is_staff. **How it works.** GET /accounts/avatar/<any user pk>/ as a staff user returns that person's uploaded or Gravatar picture; the sweep (tests/security/test_isolation_sweep.py 'accounts:avatar') proves a member gets 404, and the People page draws each person's picture (#310), so this is the intended administrator view of account metadata. The CV photo kind is never served here. **Impact.** None beyond what the threat model already grants administrators ('shows administrators accounts'). Recorded so the synthesis knows the staff branch exists and is deliberate. **Verification** (verdict: confirmed; severity after verification: Informational). No change. It is a by-design administrator capability: accounts, including a person's profile picture, are visible to staff, who are trusted with the instance. A 404 for non-staff and a redirect to sign-in for anonymous visitors are confirmed. It is worth one line in the threat model that administrators can also fetch profile pictures. **Suggested remediation.** No change needed. If the project ever wants administrators to see only the account list without faces, drop the is_staff branch and have the People page fall back to initials.

tiagoagueda added the

enhancement

security

labels

2026-10-10 10:56:37 +00:00

tiagoagueda added this to the 1.0.0 milestone

2026-10-10 10:58:03 +00:00

tiagoagueda referenced this issue

2026-10-10 10:58:40 +00:00

Security audit of 2026-10-10: index of PST-001 to PST-098 (#730–#827) #828

tiagoagueda referenced this issue from a commit

2026-10-12 15:59:57 +00:00