File: crates/state/src/materialize.rs:448-454
Severity: security
Obvious? no
AssignRole only mutates state when state.members.get_mut(peer_id) succeeds — so it is safe in isolation. But because GrantPermission (F7, #574) silently materializes a member entry from any admin, the role-assignment then attaches to a "ghost" member. This compounds F7: an admin can author GrantPermission { peer_id: P, permission: SendMessages } for a never-joined peer, then AssignRole { peer_id: P, role_id: ... }, creating a phantom member with roles.
Fix: same as F7 (#574) — gate member creation on a self-signed join/profile event from peer_id.
Filed by /general-audit @ 6404719 (2026-05-03). master: #567.
File:
crates/state/src/materialize.rs:448-454Severity: security
Obvious? no
AssignRoleonly mutates state whenstate.members.get_mut(peer_id)succeeds — so it is safe in isolation. But becauseGrantPermission(F7, #574) silently materializes a member entry from any admin, the role-assignment then attaches to a "ghost" member. This compounds F7: an admin can authorGrantPermission { peer_id: P, permission: SendMessages }for a never-joined peer, thenAssignRole { peer_id: P, role_id: ... }, creating a phantom member with roles.Fix: same as F7 (#574) — gate member creation on a self-signed join/profile event from
peer_id.Filed by
/general-audit@6404719(2026-05-03). master: #567.