CVE-2026-80348: Missing Authorization in TarsCloud TarsWeb

TarsWeb enforces per-application roles by calling AuthService in controller methods, but four methods in app/controller/patch/PatchController.js lack these authorization calls. The uploadAndPublish method can upload and deploy packages to any server without verifying developer authorization, only checking if the server is registered. Other methods like downloadPackage, deletePatchPackage, and setPatchPackageDefault operate on packages identified by unscoped primary keys, allowing any authenticated user, regardless of scoped roles, to manipulate packages across all applications managed by the console. This results in unauthorized package deployment, retrieval, deletion, and default package changes across applications.

Any authenticated user, even with roles scoped to unrelated applications, can push and deploy packages on any server managed by TarsWeb, retrieve or delete packages from any application, and alter which package is deployed by default. This can lead to unauthorized code execution, data manipulation, and potential disruption of application deployments across the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to TarsWeb to trusted users only and monitor for unusual package deployment activities. Avoid granting broad authenticated access to users without verifying their authorization scope. Follow vendor updates closely for any forthcoming patches or official mitigations.