CVE-2026-45147

### Summary `POST /api/tag/getTag` is registered with `model.CheckAuth` only, omitting both `model.CheckAdminRole` and `model.CheckReadonly`, despite the handler performing a configuration write that is normally guarded by both. Any authenticated user — including publish-service `RoleReader` accounts and `RoleEditor` accounts on a read-only workspace — can call this endpoint with a `sort` argument to mutate `model.Conf.Tag.Sort` and trigger `model.Conf.Save()`, which atomically rewrites the entire workspace `conf.json`. Same root-cause class as the patched `GHSA-4j3x-hhg2-fm2x` (which fixed missing `CheckAdminRole + CheckReadonly` on `/api/template/renderSprig`). ### Details **Affected files / lines (v3.6.5):** `kernel/api/router.go:170` — only `CheckAuth`: ```go ginServer.Handle("POST", "/api/tag/getTag", model.CheckAuth, getTag) // Compare the sibling registrations on the next two lines, which DO gate writes: ginServer.Handle("POST", "/api/tag/renameTag", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, renameTag) ginServer.Handle("POST", "/api/tag/removeTag", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeTag) ``` `kernel/api/tag.go:28-64` — handler. The `if nil != arg["sort"]` block writes config without any role check: ```go func getTag(c *gin.Context) { ret := gulu.Ret.NewResult() defer c.JSON(http.StatusOK, ret) arg, ok := util.JsonArg(c, ret) if !ok { return } ... if nil != arg["sort"] { // ← unauthorized write path sortVal, ok := util.ParseJsonArg[float64]("sort", arg, ret, true, false) if !ok { return } model.Conf.Tag.Sort = int(sortVal) model.Conf.Save() // persists entire conf to <workspace>/conf/conf.json } ... } ``` `Conf.Save()` rewrites the **entire** configuration file, which means a malicious caller racing with a legitimate config change can roll back another user's setting (TOCTOU on the global config objec