[BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass)

[Aias00]

• severity: High
• files: shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java:124-136
• description: selectByIdListAndNamespaceId(ids, namespaceId) scopes the existence check by namespaceId, but the subsequent metaDataMapper.updateEnableBatch(ids, enabled) (line 132) is passed the raw ids with no namespaceId filter (verified: the mapper SQL at meta-data-sqlmap.xml:225 is WHERE id IN (...) with no namespace). If a caller in namespace A supplies ids = [id-in-A, id-in-B], the select returns only the A row (non-empty), so the method proceeds, and updateEnableBatch enables/disables the B row too.
• impact: A user scoped to one namespace can enable/disable metadata belonging to another namespace, breaking namespace isolation and potentially disabling traffic in unrelated namespaces.
• suggested_fix: Pass the filtered id list (metaDataDoList.stream().map(MetaDataDO::getId)) to updateEnableBatch, or add a namespaceId overload of the mapper update.
• confidence: High
• related_existing: none. The baseline MetaData items cover other concerns; this is a cross-namespace mutation bug.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass)
• Link: [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass) #6615

Please review when you have time. Thank you! 🙏

[wy471x]

/assign