OpenStack Aodh (Telemetry Alarming) contains an incorrect authorization flaw in the alarm listing API endpoint. In AlarmsController.get_all() in aodh/api/controllers/v2/alarms.py, when the all_projects query parameter is present with a value of false, the code enters the 'if all_projects in keys' branch and removes all_projects from the filter keys, but skips both the admin-only policy enforcement and the else branch that normally adds project_id scoping. This results in a database query with no project_id filter, returning alarms from all projects.

A non-admin user with project_reader role can enumerate all alarms across all projects by setting all_projects=false, and can target a specific foreign project by combining this with a project_id filter. Leaked data includes alarm names, types, configurations, project/user IDs, and action URLs. Trust IDs are scrubbed from trust+* URLs by from_db_model_scrubbed, but base webhook URLs and plain http/https action URLs are returned unmodified.

The correct behavior is demonstrated by the metrics controller (aodh/api/controllers/v2/metrics.py), which applies project_id filtering in both the True and False branches.

Affected versions per upstream: >=10.0.0 <20.0.1, ==21.0.0, ==22.0.0.
Fix: proposed patches attached to the PSIRT ticket; not yet publicly released.
Reporter: Chen YuXiang, Institute of Computing Technology, Chinese Academy of Sciences.
Upstream bug: LP#2161276.
PSIRT ticket: PSIRTSUPT-21526.