CRITICAL: Cross-tenant notification data exfiltration via global rule query

[namann5]

Severity: High (CVSS 7.5)

Vulnerability Description

The process_finding_notifications function in backend/secuscan/notification_service.py:647-662 fetches ALL active notification rules across ALL tenants without an owner_id filter:

async def process_finding_notifications(db, finding_id):
    finding = await db.fetchone("SELECT * FROM findings WHERE id = ?", (finding_id,))
    rules = await db.fetchall(
        "SELECT * FROM notification_rules WHERE is_active = 1 ORDER BY created_at ASC"
    )
    for rule in rules:
        results.append(await deliver_via_rule(db, rule, finding))

Every finding generated by any tenant triggers delivery to every active rule owner's webhook endpoint.

Exploit Scenario

1. User B creates a notification rule with severity_threshold: "info" (lowest threshold) pointing to their webhook
2. User A runs a scan that produces high-severity findings about their infrastructure
3. process_task_notifications is called for User A's task
4. process_finding_notifications retrieves User B's rule (no owner filter)
5. Full finding data (title, target, description, remediation, metadata) is POSTed to User B's webhook
6. User B exfiltrates User A's complete security posture data

Security Impact

• Cross-tenant sensitive data exfiltration through notification channels
• Complete leak of scan results, vulnerability details, and infrastructure information
• Any authenticated user can passively receive all other users' scan findings

Recommended Fix

Scope the notification rules query to the finding's owner:

rules = await db.fetchall(
    "SELECT * FROM notification_rules WHERE is_active = 1 AND owner_id = ? ORDER BY created_at ASC",
    (finding.get("owner_id", "default"),),
)

Affected Files

• backend/secuscan/notification_service.py (lines 647-662)