Security: Missing authentication/authorization on admin routes and CRUD generator

[lighthousekeeper1212]

Summary

Multiple critical authorization vulnerabilities allow unauthenticated and unauthorized access to all admin functionality including a CRUD generator that executes Artisan commands.

Findings

1. No authentication middleware on admin routes (CRITICAL)

Admin routes lack auth middleware group protection. Unauthenticated users can access admin panel functionality directly by navigating to admin URLs.

2. No controller-level authorization (CRITICAL)

Admin controllers perform no role or permission checks. Any authenticated user (including regular users) can access all admin functionality — user management, settings, etc.

3. Unauthenticated CRUD generator endpoint (CRITICAL)

The CRUD generator endpoint allows unauthenticated users to trigger Artisan commands for creating models, migrations, and controllers. This is effectively remote code generation on the server.

4. Mass assignment vulnerability (HIGH)

Controllers use $request->all() or accept all input fields without $fillable/$guarded protection, allowing attackers to set unintended model attributes (e.g., is_admin flag).

5. CheckRole middleware logic bug (MEDIUM)

The role-checking middleware has a logic error that can be bypassed under certain conditions, undermining the intended role-based access control.

Recommended Fix

1. Wrap all admin routes in auth + role-checking middleware group
2. Add $this->authorize() or middleware-based permission checks in controllers
3. Protect or remove the CRUD generator endpoint in production
4. Use $request->only([...]) or define $fillable on models
5. Fix CheckRole middleware logic to properly deny unauthorized access

Impact

Any user (including unauthenticated visitors) can access admin functionality, manage users, and trigger server-side code generation.