IDOR: users can attach another user's platform links to their own cards

[Ridanshi]

Summary

Fix a broken access control vulnerability where authenticated users can attach another user's platform links to their own DevCard profile by supplying arbitrary platformLink IDs.

This allows profile impersonation and violates ownership guarantees across public cards.

---

Contexts

cards.ts accepts linkIds from the client and directly creates CardLink records without validating ownership.

Currently, any authenticated user can:

1. fetch another user's public profile,
2. obtain exposed platformLink IDs,
3. create/update a card using those IDs,
4. display another user's verified social profiles as their own.

Affected areas:

• apps/backend/src/routes/cards.ts
• apps/backend/src/routes/public.ts

Example vulnerable pattern:

platformLinkId: linkId

[Ridanshi]

Hi @Harxhit,
I would like to work on this issue as part of GSSoC 2026. The issue is reproducible and I already have a minimal, isolated fix approach prepared for ownership validation in the affected card routes.
Kindly assign this issue to me. Thank you!

[Harxhit]

Hi @Harxhit, I would like to work on this issue as part of GSSoC 2026. The issue is reproducible and I already have a minimal, isolated fix approach prepared for ownership validation in the affected card routes. Kindly assign this issue to me. Thank you!

Please wait for 24 hours, as this is the assignment protocol we follow before assigning issues. Thank you for your patience and understanding.

[smirk-dev]

I'd like to work on this as part of GSSoC'26. My approach: add a ownership check in the cards.ts route that verifies each platformLink ID being attached belongs to the authenticated user before creating the CardLink record. I'll query platformLink by ID and compare userId against request.user.id, returning 403 on mismatch. Happy to have a clean PR ready. Please assign this to me!

[Harxhit]

@Ridanshi I have assigned the issue to you.

[Ridanshi]

Implemented and submitted in PR #183. This fixes the ownership validation issue by preventing users from attaching platform links that do not belong to their account. Kindly review it @Harxhit.
Thank you!