Marzban panel missing authorization checks leading to unauthorized operations and privilege-exceeding data disclosure
The vulnerability originates from missing authentication middleware configuration on core business routes: multiple critical endpoints do not inject the administrator identity dependency, allowing an attacker to bypass basic session validation and craft HTTP requests that trigger state-changing logic directly. Exploitation vectors include unauthenticated calls to plan activation endpoints, defects in the superadmin token revocation mechanism, and authorization gaps in user information query paths. A malicious entity can, without interaction, bulk-reset target traffic quotas, silently restore disabled accounts or extract complete proxy credential configurations. Affected systems face forced overwriting of core business rules; an illegitimate actor gains long-lived highest administrative privileges and causes large-scale plaintext exposure of subscription credentials, breaking the service trust chain and the integrity of data boundaries.
- It is recommended that developers introduce a mandatory identity dependency injection mechanism uniformly at the route definition layer, ensuring every endpoint involving state changes or data reads passes strict contextual authorization checks. Token validation logic should also be restructured to eliminate early-return shortcuts for privileged accounts, the latest database security state should be synchronized forcibly, and boolean operator precedence should undergo static code review to prevent misjudged logic branches.
