Summary Three custom API-Platform controllers under `src/CoreBundle/Controller/Api/` perform privileged mutations but enforce only a global platform role (`ROLE_TEACHER`) — or, in one case, no authorization at all — instead of a per-object voter (`is_granted('EDIT', object.resourceNode)`). The result: - Issue 1 — cross-course document overwrite (stored XSS): any user holding `ROLE_TEACHER` in any one of their own courses can overwrite any document in any other course on the platform → cross-course integrity loss + stored XSS in legitimate HTML/SCORM content served to other courses' students. - Issue 2 — unauthenticated video-conference meeting hijack: the video-conference callback endpoint has no `security:` and is not covered by any authentication-requiring `access_control`, so an unauthenticated attacker who knows a meeting's `remoteId` (shared in every join link) can change its owner, reset the moderator/attendee passwords (→ join as moderator = meeting hijack), and inject malicious recording URLs. - Issue 3 — cross-course grade tampering: any user holding `ROLE_TEACHER` anywhere can attach a "correction" file and overwrite the grade (to 0, marked accepted) on any student's assignment submission in any course. Root cause is identical across all three: role-based instead of object-based authorization. The same codebase already does this correctly on sibling operations (e.g. `UpdateDocumentFileAction` uses `is_granted('EDIT', object.resourceNode)`), which makes these clear defects rather than design choices. Impact - Class: CWE-285 / CWE-863 (Improper / Incorrect Authorization), CWE-639 (IDOR), CWE-345 (Insufficient Verification of Data Authenticity — Issue 2 callback). - Issue 1 — cross-course arbitrary document overwrite → platform-wide stored XSS (session-cookie theft / drive-by in students' browsers), certificate/lecture/SCORM tampering. CVSS `AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N` ≈ 8.7 High (the file-overwrite integrity impact alone is `UI:N`). - Issue 2 — unauthenticated meeting hijack: reset moderator password → join as moderator (mute/kick/record/observe all attendees), reassign owner (audit-trail forgery), inject malicious recording URLs viewed by participants. CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L` ≈ 9.4 Critical (AC rises to High if the target `remoteId` must be brute-forced rather than read from a join link). - Issue 3 — cross-course grade tampering: zero-out and "accept" any student's submission in any course, attach fake correction files. CVSS `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N` ≈ 6.5 Medium. Suggested fix For Issue 1 and Issue 3, replace the role-based expression with object-based authorization: ```php security: "is_granted('EDIT', object.resourceNode)" ``` or, in each controller after resolving the target entity, call `$this->denyAccessUnlessGranted(ResourceNodeVoter::EDIT, $entity->getResourceNode())` (Issue 3 must check the submission's resource node, not the new correction). For Issue 2, move the `if (!$isAuthenticated) { return Unauthorized; }` guard to the top of `__invoke()` so the HMAC signature is required before any meeting mutation — or declare a `security:` on the operation that mandates a valid signature header. The callback must never be reachable anonymously. Credits - Reporter: Nguyen Manh Thuan (manhthuan.2902@gmail.com) - Discovery date: 2026-05-21 - Disclosure: Coordinated with Chamilo maintainers