Executive brief
TarsWeb is a dashboard for managing the TARS microservices framework. Four methods in its patch controller fail to validate application-level permissions, allowing any authenticated user to deploy packages to any server, delete other applications' packages, and override default deployment settings. This breaks multi-tenancy isolation and enables attackers to disrupt service deployments or extract competitor configurations.
Technical details
TarsWeb enforces per-application role-based access control via AuthService checks in most controller methods, but four methods in app/controller/patch/PatchController.js (uploadAndPublish, downloadPackage, deletePatchPackage, and setPatchPackageDefault) skip these checks. The vulnerability stems from missing authorization enforcement in these methods and unscoped database lookups using sequential primary keys. Attackers need only valid authentication credentials to any account (including those with single-application scope); no network exploit is required. The impact includes arbitrary code execution via package deployment, data exposure through package retrieval, denial of service via deletion or default package changes, and cross-application compromise in multi-tenant deployments. Patches addressing this authorization bypass have been released.
Affected products
- TarsCloud TarsWeb v3.0.16 and earlier
Timeline
- 2026-08-26: disclosed