A missing authorization flaw was found in fedora-infra/anitya. The delete_user() function in anitya/admin.py (around line 671) is decorated with @login_required but lacks the is_admin() authorization check that is present on every other administrative route in the same module (12+ sibling functions). This allows any authenticated user to delete arbitrary user records, including administrator accounts, by sending requests to /users/<user_id>/delete. The route accepts both GET and POST methods. CSRF is not a barrier: an authenticated attacker can obtain a valid token from the GET confirmation page, then POST confirm=true to commit db.session.delete(user).

Dynamic reproduction (local Flask test client, SQLite, Anitya 2.2.2): a non-admin user (attacker, admin=False) received HTTP 200 on GET /users/<victim_id>/delete and successfully deleted an admin victim. After the POST, the victim row was gone from the database. A control request to GET /distro/TestDistro/delete as the same non-admin correctly returned 401 because that sibling route has is_admin().

The vulnerability exists in version 2.2.2 and appears to have been introduced when the route was first added. No upstream fix is available yet.

Reporter: Arpit Jain (independent security researcher, GitHub: arpitjain099)
PSIRT ticket: PSIRTSUPT-21968