GHSA-w8jj-cwmc-wgq2

## Summary The system log endpoints (`GET /api/system/logs`, `GET /api/system/logs/stream`, `WS /ws/system/logs`) lack authorization checks, allowing any authenticated non-admin user to read and stream all server logs. These logs contain error stack traces, internal file paths, module names, and arbitrary structured fields that facilitate reconnaissance for further attacks. ## Details The dashboard routes in `internal/router/dashboard.go:7-8` register log endpoints on the `AuthRouterGroup` without any `RequireScopes` middleware: ```go // internal/router/dashboard.go func setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { appRouterGroup.AuthRouterGroup.GET("/system/logs", h.DashboardHandler.GetSystemLogs()) appRouterGroup.AuthRouterGroup.GET("/system/logs/stream", h.DashboardHandler.SSESubscribeSystemLogs()) appRouterGroup.WSRouterGroup.GET("/system/logs", h.DashboardHandler.WSSubscribeSystemLogs()) } ``` Compare with other admin-only routes that properly use `RequireScopes`: ```go // internal/router/setting.go — every route has RequireScopes appRouterGroup.AuthRouterGroup.GET("/settings", middleware.RequireScopes(authModel.ScopeAdminSettings), h.SettingHandler.GetSiteSettings()) ``` The `AuthRouterGroup` only applies `JWTAuthMiddleware()` (router.go:36), which validates the JWT and sets the viewer context but does **not** check admin status. The `WSRouterGroup` (router.go:37) has no middleware at all — the WebSocket handler only calls `ParseToken` to verify the JWT signature (dashboard.go:74) without any role/scope validation. The handler (`internal/handler/dashboard/dashboard.go:29-62`) and service (`internal/service/dashboard/dashboard.go:21-27`) contain zero authorization checks. Other services in the codebase properly enforce admin access: - `internal/service/inbox/inbox.go:132` — `ensureAdmin()` - `internal/service/migrator/migrator.go:360` — `ensureAdmin()` - `internal/service/comment/comment.go:719` — `requireAdmin()`