Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Admin panel and account routes have no authentication at all

Open
  • Is something wrong?
#366 0 comments 0 reactions 0 assignees View on GitHub

@DarioDeSilva is already working on this.

Since Oct 7, 2026.

  • #378 by @DarioDeSilva — open

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
authentication, backend, security

Research direction

Start with the listed handlers in backend/routes/user.py, then inspect the existing authentication and role-check helpers to understand how system-level admin access is represented. The issue also points to fetch calls in pages/admin/* and pages/editAccount/index.js; review those after the backend checks. Done means the listed routes reject unauthenticated or non-admin access and the frontend sends credentials; linked PR #378 is already open.

Written by the indexing model from the issue text.

Description

The admin panel (pages/admin/*) and the account-edit page (pages/editAccount/index.js) call several backend routes that have no authentication check at all — not require_authenticated(), not any role check. Confirmed by reading each route directly:

  • get_all_courses, get_all_instructors, get_all_students (backend/routes/user.py) — return every course/instructor/student in the system to anyone who calls them, logged in or not.
  • create_user, delete_user, admin_update_account (backend/routes/user.py) — let anyone create, delete, or edit any user account, no auth required.
  • get_user_by_id, update_account (backend/routes/user.py) — let anyone read or modify any user's account details given their ID.
  • get_instructor_by_eid, get_courses_by_instructor — similar unauthenticated lookups.

On the frontend, none of the corresponding fetch() calls in pages/admin/* or pages/editAccount/index.js send credentials: "include" either, but that's secondary — even with credentials, these routes don't check who (if anyone) is calling them, let alone whether they're an admin.

This is a real security gap: right now, anyone who knows (or guesses) a user ID can read or edit any account, and the entire admin panel's data is publicly readable with no login. Fixing it means adding an admin-role auth check (presumably a new check, since require_course_role is course-scoped and this is account/system-level) to each of these routes, then fixing the frontend fetches to send credentials once there's an auth check for them to matter against.

Found during a deep-dive audit of frontend/src fetch calls after Cecilia's review of PR #355, while checking for other instances of the missing-credentials pattern she found. Not currently causing a user-visible bug (no auth check to fail against yet), but a real, separate finding worth its own tracking given the security implications, especially before this platform goes live.

Dominant language
Python
Stars
13
Forks
0
Avg merge
2h 4m
Merged PRs (30d)
1

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from kiat/codeAssist

All issues in kiat/codeAssist

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.