Rudder

• I log in as a user in a tenant which has access to a single node root, and I generate an API token
• OR I use an API account token with the same tenant access

, I can still find all node ids of any group in the groups details endpoint /api/groups/{groupId}/ :

{
  "action": "groupDetails",
  "result": "success",
  "data": {
    "groups": [
      {
         ...,
         "nodeIds": [
           "0e7eedc8-d6af-4d68-a7f8-eec615a4bc1a",
           "root" 
         ]
       }
     ]
   }
}

Especially when I query the group all-nodes-with-cfengine-agent, I can know all node ids in Rudder even outside of my tenant. But I don't have access to node details in /api/nodes/{nodeId}, nor to those nodes in the groups page.

This groups API endpoint should not leak node ids : the list of nodes ids should be filtered to include only the ones in the tenants.