Summary
POST /api/v1/jobs/:jobId/cancel authenticated the caller but never checked that the job belonged to them. Any authenticated user who knew or guessed a job id could cancel another user's job.
Impact
An authenticated user could cancel work belonging to any other user on the instance, destroying in-flight processing and its result. Job ids are UUIDs, so this is not trivially enumerable, but ids are visible to a user across the SSE progress stream and the job APIs for their own work, and any leaked or logged id is enough.
The impact is limited to availability of another user's job. No file contents, job settings or account data were exposed by this endpoint.
Patches
Fixed in 2.2.0. Versions 2.0.0 through 2.1.0 are affected.
The endpoint now loads the job's owner and allows cancellation only for that owner, or for a caller holding files:all. Missing jobs and jobs owned by someone else both return 404, so the endpoint does not leak whether a given job id exists. The route moved into a shared registerJobRoutes() so the ownership check sits behind test coverage.
Workarounds
None beyond upgrading. Any authenticated account can reach the endpoint, so the exposure only closes on 2.2.0.
References
Fix: #599 (commit 577d74b)
Credit
Reported by Alpesh Bhagwatkar, https://github.com/Alpastx.
Alpastx Reporter
Summary
POST /api/v1/jobs/:jobId/cancelauthenticated the caller but never checked that the job belonged to them. Any authenticated user who knew or guessed a job id could cancel another user's job.Impact
An authenticated user could cancel work belonging to any other user on the instance, destroying in-flight processing and its result. Job ids are UUIDs, so this is not trivially enumerable, but ids are visible to a user across the SSE progress stream and the job APIs for their own work, and any leaked or logged id is enough.
The impact is limited to availability of another user's job. No file contents, job settings or account data were exposed by this endpoint.
Patches
Fixed in 2.2.0. Versions 2.0.0 through 2.1.0 are affected.
The endpoint now loads the job's owner and allows cancellation only for that owner, or for a caller holding
files:all. Missing jobs and jobs owned by someone else both return 404, so the endpoint does not leak whether a given job id exists. The route moved into a sharedregisterJobRoutes()so the ownership check sits behind test coverage.Workarounds
None beyond upgrading. Any authenticated account can reach the endpoint, so the exposure only closes on 2.2.0.
References
Fix: #599 (commit 577d74b)
Credit
Reported by Alpesh Bhagwatkar, https://github.com/Alpastx.