Description

The gateway adds WebSocket subscription methods that allow any connected client with READ scope to subscribe to:

• Global session lifecycle/message events via sessions.subscribe (no per-device/session authorization)
• Per-session message events via sessions.messages.subscribe for an arbitrary key

Once subscribed, createTranscriptUpdateBroadcastHandler broadcasts session.message and sessions.changed payloads that include an includeSession: true snapshot (sessionRow) and additional metadata (e.g., spawnedWorkspaceDir, deliveryContext, token/cost usage, model/provider, etc.) to all sessionEventSubscribers.

This creates an information disclosure/IDOR risk in multi-client deployments (multiple paired devices, operator UIs, remote access): any client granted READ scope can passively receive updates about all sessions and potentially subscribe to sessions they should not observe.

Vulnerable code (subscription endpoints + broadcast fanout):

​// sessions.subscribe: global subscription, no further authorization
"sessions.subscribe": ({ client, context, respond }) => {
  const connId = client?.connId?.trim();
  if (connId) {
    context.subscribeSessionEvents(connId);
  }
  respond(true, { subscribed: Boolean(connId) }, undefined);
},

​// broadcast: sends full session snapshot to all global subscribers
for (const connId of params.sessionEventSubscribers.getAll()) {
  connIds.add(connId);
}
...
const sessionSnapshot = buildGatewaySessionSnapshot({
  sessionRow: loadGatewaySessionRow(sessionKey),
  includeSession: true,
});
params.broadcastToConnIds("session.message", { ...sessionSnapshot, ... }, connIds, ...);

Recommendation

Add authorization checks to subscription registration and to broadcast fanout.

Minimum hardening options:

1. Restrict global subscription (sessions.subscribe) to an admin/operator scope intended for full visibility (or remove it entirely), and require explicit per-session subscriptions only.

2. Enforce per-session access control in sessions.messages.subscribe:

   • Verify the requesting device/user is allowed to access the target canonicalKey (e.g., session ownership, allowed agent/workspace, or an ACL).

3. Filter broadcast recipients:

   • Instead of broadcasting sessions.changed to sessionEventSubscribers.getAll(), broadcast only to subscribers authorized for that sessionKey.

Example (conceptual):

​// sessions.messages.subscribe
if (!context.canAccessSession(client, canonicalKey)) {
  respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, "unauthorized session"));
  return;
}
context.subscribeSessionMessageEvents(connId, canonicalKey);

​// server-session-events fanout
const allowedConnIds = new Set<string>();
for (const connId of params.sessionMessageSubscribers.get(sessionKey)) {
  allowedConnIds.add(connId);
}
​// optionally: add global subscribers only if they have an admin scope

Also consider minimizing the snapshot: avoid including full sessionRow (includeSession: true) unless strictly required, and omit fields like filesystem paths (spawnedWorkspaceDir) and deliveryContext from broadcast payloads unless the subscriber is privileged.