MEDIUM: Setup endpoint race condition — multiple admin users can be created #26

New Issue

2026-02-16T05:47:14+01:00

clawbot commented

2026-02-16 05:47:14 +01:00

Bug

Files:

internal/handlers/setup.go, HandleSetupPOST()
internal/service/auth/auth.go, CreateUser()
internal/middleware/middleware.go, SetupRequired()

Severity: MEDIUM — Authentication bypass

Description

There is a TOCTOU (Time-of-Check-Time-of-Use) race condition in the setup flow:

SetupRequired() middleware checks if any users exist
HandleSetupPOST() processes the form
CreateUser() checks UserExists() again, then inserts

If two requests arrive simultaneously (e.g., automated attack while the setup page is accessible), both can pass the UserExists() check before either has inserted a user. The second insert may succeed (SQLite doesn't have a UNIQUE constraint on username based on the migration), creating a second admin account.

Even if the second CreateUser returns ErrUserExists, the middleware check at step 1 happens independently for each request.

Suggested Fix

Add a UNIQUE constraint on users.username in the database schema

Use a mutex in CreateUser or use an INSERT with conflict handling:

INSERT INTO users (username, password_hash) VALUES (?, ?)
ON CONFLICT(username) DO NOTHING

The CreateUser function should check row count after insert to detect conflicts

## Bug **Files:** - `internal/handlers/setup.go`, `HandleSetupPOST()` - `internal/service/auth/auth.go`, `CreateUser()` - `internal/middleware/middleware.go`, `SetupRequired()` **Severity:** MEDIUM — Authentication bypass ### Description There is a TOCTOU (Time-of-Check-Time-of-Use) race condition in the setup flow: 1. `SetupRequired()` middleware checks if any users exist 2. `HandleSetupPOST()` processes the form 3. `CreateUser()` checks `UserExists()` again, then inserts If two requests arrive simultaneously (e.g., automated attack while the setup page is accessible), both can pass the `UserExists()` check before either has inserted a user. The second insert may succeed (SQLite doesn't have a UNIQUE constraint on username based on the migration), creating a second admin account. Even if the second `CreateUser` returns `ErrUserExists`, the middleware check at step 1 happens independently for each request. ### Suggested Fix 1. Add a UNIQUE constraint on `users.username` in the database schema 2. Use a mutex in `CreateUser` or use an INSERT with conflict handling: ```sql INSERT INTO users (username, password_hash) VALUES (?, ?) ON CONFLICT(username) DO NOTHING ``` 3. The `CreateUser` function should check row count after insert to detect conflicts

sneak commented

2026-02-16 06:33:02 +01:00

implement 1 and 2 and give me a PR

clawbot referenced a pull request that will close this issue

2026-02-16 06:35:39 +01:00

fix: prevent setup endpoint race condition (closes #26) #31

sneak closed this issue

2026-02-16 06:45:02 +01:00

sneak referenced this issue from a commit

2026-02-16 06:45:04 +01:00

fix: prevent setup endpoint race condition (closes #26)

sneak referenced this issue from a commit