Summary

Multiple admin controllers expose DataTable endpoints without authorization checks,
allowing any authenticated user to access sensitive administrative data
that should be restricted to administrators only.

Details

The following admin controllers define datatable() methods that are reachable
via GET requests but lack any permission or role verification. Because the routes
fall under the /admin/ prefix, operators may assume they are protected - however,
the middleware applied to this route group does not enforce admin-level
authorization on these specific endpoints.

As a result, any authenticated user (regardless of role) can query these endpoints
and receive paginated JSON responses containing sensitive records.

Affected controllers:

PoC

Log in as any regular (non-admin) user and send the following request:

GET /admin/users/datatable HTTP/1.1
Host: <panel_url>
Cookie: <valid_session_cookie>

The response returns a JSON DataTable payload containing all registered users'
email addresses, IP addresses, roles, and account metadata.

The same technique applies to all endpoints listed in the table above.

Impact

An authenticated attacker can enumerate:

• User PII - email addresses and last-known IP addresses of all registered
  users, enabling targeted phishing or account correlation
• Payment and transaction records - processor-level transaction IDs
  (Stripe pi_*, PayPal order IDs), amounts, and linked usernames -
  potential violation of PCI-DSS / GDPR depending on deployment
• Active voucher and coupon codes - valid codes with remaining uses and
  expiry dates, enabling unauthorized financial abuse
• Role and permission structure - full privilege hierarchy, aiding
  privilege escalation attempts
• Server ownership mappings - server identifiers, owners, and billing
  details, aiding further reconnaissance
• Support ticket contents - message bodies and metadata, potentially
  containing sensitive user communications

Remediation

Add an appropriate authorization check at the beginning of each affected
datatable() method, using the panel's existing permission system.
The specific permission or permission group will vary by controller -
refer to the checks already applied to other actions within the same
controller as a reference.

This brings the datatable() methods in line with the permission model
already enforced throughout the rest of the admin area.