GHSA-x287-5c68-36wp

## Summary OpenWISP IPAM is multi-tenant: every `Subnet` belongs to an `organization`, and API access is scoped to the organizations a user belongs to. The CSV **export** endpoint, `ExportSubnetView`, omits the organization-membership check that its **import** sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to **another** organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id. ## Details `ImportSubnetView.post()` authorizes first, by calling `assert_organization_permissions()`: ```python # openwisp_ipam/api/views.py (ImportSubnetView) def post(self, request, *args, **kwargs): self.assert_organization_permissions(request) # <-- org-membership check file = request.FILES["csvfile"] ... self.subnet_model().import_csv(file) ``` ```python # openwisp_ipam/api/utils.py:16 (AuthorizeCSVImport) def assert_organization_permissions(self, request): if request.user.is_superuser: return # ... otherwise verifies the user belongs to the target organization ``` `ExportSubnetView.post()` performs **no** such check. It is declared with `IpAddressOrgMixin` (whose organization scoping lives in `get_queryset()`), but its overridden `post()` never calls `get_queryset()` **or** `assert_organization_permissions()` — it goes straight to `export_csv()`: ```python # openwisp_ipam/api/views.py:246 class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView): subnet_model = Subnet def post(self, request, *args, **kwargs): response = HttpResponse(content_type="text/csv") response["Content-Disposition"] = 'attachment; filename="ip_address.csv"' writer = csv.writer(response) self.subnet_model().export_csv(kwargs["subnet_id"], writer) # no org check reached return response ``` `export_cs