youngkermit8-coder opened a new issue, #2045: URL: https://github.com/apache/rocketmq-dashboard/issues/2045
## Problem `GET /api/acl/remote/rules` is currently treated as an ordinary reader GET by `AuthInterceptor`. The endpoint is not a passive read from Studio's local store: `ApacheAclReadService` resolves the selected instance, uses its stored administrative RocketMQ credentials, connects to every broker, and returns live ACL 2.0 subjects, resource rules, source-IP restrictions, and broker addresses. A non-admin Studio reader can therefore trigger privileged broker calls with credentials they do not own and enumerate the cluster's authorization policy. Similar GET routes that use saved secrets for LLM model discovery and cloud inventory are already restricted to administrators. ## Expected behavior Require administrator permission for `/api/acl/remote/rules` (including trailing-slash and matrix-parameter variants) while keeping local, masked ACL list/capability reads available to readers. ## Suggested verification - a reader receives 403 for remote ACL policy discovery - an administrator is allowed - ordinary local ACL GET routes remain reader-accessible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
