Audit an administrator's access to a sharing account

jcoffey-dev commented

2026-10-10 04:53:47 +00:00

Owner

Fix for GHSA-m992-gp7g-wc2j. A share no longer counts as access to the whole account, so an admin reaching into an account that shared something with them gets an accountAccess record like any other. Admins using a real share get logged too, which is the safer side for an audit log.

jcoffey-dev added 1 commit 2026-10-10 04:53:48 +00:00

Audit an administrator's access to a sharing account

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 7m5s

Details

3e7e7bd2da

AU-1.6 records access to another account through Impersonate, but it
treated any share from that account as the owner's grant for the whole
account. A share covers only the folders or calendars it names, so an
administrator could read and change everything else in an account that
had shared anything with them, without a record (GHSA-m992-gp7g-wc2j).

is_member_directly now counts only the token's own account and its
groups. Access to a sharing account is recorded like any other, once an
hour; using a share as an administrator is recorded too, which errs on
the side of the audit log.

Test 3b in the audit suite fails without this change.

jcoffey-dev referenced this pull request

2026-10-10 04:54:55 +00:00

Release 2026.10.10.1 #185

jcoffey-dev merged commit 8d12fd951e into main

2026-10-10 05:39:03 +00:00

jcoffey-dev deleted branch fix/audit-access-through-shares

2026-10-10 05:39:03 +00:00

Audit an administrator's access to a sharing account #184