Executive brief
TSI DPDP CMS is an open-source consent management system for India's data protection law. The system relies entirely on browser-side JavaScript to enforce authentication, allowing unauthenticated attackers to bypass login by making direct HTTP requests (e.g., via curl or Burp Suite). Attackers gain access to sensitive console pages, internal API endpoints, database field schemas, and complete application logic without credentials.
Technical details
This vulnerability stems from client-side enforcement of server-side security (CWE-602) combined with missing authentication for critical functions (CWE-306). The application delivers all 17 admin and DPO console pages with HTTP 200 responses unconditionally—no server-side credential verification occurs before serving sensitive pages. Authentication is implemented solely as JavaScript code that reads an authToken from localStorage and redirects users to login; any HTTP client that does not execute JavaScript (curl, wget, Python, Burp) receives the full page source including 100+ KB of JavaScript application logic, 12+ internal REST API endpoints, 50+ function dispatch values, and complete API contracts. Attackers can enumerate all operations (breach management, ROPA lifecycle, API key generation, user administration, etc.) and construct authenticated requests once the localStorage format is known. Upgrade to version 0.5.1 or later to resolve this issue.
Affected products
- TSI-Coop TSI DPDP CMS up to 0.5.0
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 0.5.1