Cube API key is leaked to Developers and higher in the same group

⚠ Please read the process on how to fix security issues before starting to work on the issue. Vulnerabilities must be fixed in a security mirror.

HackerOne report #2502047 by yvvdwf on 2024-05-12, assigned to @ottilia_westerlund:

Report | How To Reproduce

Report

Hello,

This code exposes cube_api_key to members having at least developer role.

Reproduce at gitlab.com

1. As maintainer (or Owner) of an existing project (or create a new project) which has Ultimate plan:

• go to Settings / Analytics / Data source, then fill the form as you want

2. As a project member which has Developer role:

• go to Analyze / Analytics dashboards
• view source code of the page
• you should see cube_api_key value in the code

Impact

Expose cube_api_key to other project members:

• S:C as cube_api_key can be used to access to cube.dev data source
• PR:L as a member having Developer role can access to

Best regards,
yvvdwf

How To Reproduce

Please add reproducibility information to this section: