GHSA-hm2h-wwwh-g49x

## Summary The `PUT /user` endpoint is protected by `RequireScopes("profile:read")`, which is a read-only scope. However, the endpoint performs write operations including password changes. An attacker who obtains an admin's restricted `profile:read` access token can change the admin's password, then login to receive an unrestricted session token that bypasses all scope enforcement. ## Details The scope enforcement system defines granular scopes (e.g., `echo:read`, `echo:write`, `admin:user`) but has no `profile:write` scope. The `PUT /user` route is protected only by `profile:read`: ```go // internal/router/user.go:40-44 appRouterGroup.AuthRouterGroup.PUT( "/user", middleware.RequireScopes(authModel.ScopeProfileRead), h.UserHandler.UpdateUser(), ) ``` The `RequireScopes` middleware bypasses all scope checks for session tokens, and for access tokens only verifies the token contains the listed scopes: ```go // internal/middleware/scope.go:14-19 func RequireScopes(scopes ...string) gin.HandlerFunc { return func(ctx *gin.Context) { v := viewer.MustFromContext(ctx.Request.Context()) if v.TokenType() == authModel.TokenTypeSession { ctx.Next() return } // ... checks access token has required scopes (line 53) ``` The `UpdateUser` service checks `user.IsAdmin` but does not verify the token's scope is sufficient for write operations: ```go // internal/service/user/user.go:271-300 func (userService *UserService) UpdateUser(ctx context.Context, userdto model.UserInfoDto) error { userid := viewer.MustFromContext(ctx).UserID() user, err := userService.userRepository.GetUserByID(ctx, userid) // ... if !user.IsAdmin { return errors.New(commonModel.NO_PERMISSION_DENIED) } // ... if userdto.Password != "" && cryptoUtil.MD5Encrypt(userdto.Password) != user.Password { user.Password = cryptoUtil.MD5Encrypt(userdto.Password) // line 299 } ``` After the passwor