Deathxcore

An authenticated low-privilege user can permanently deactivate any other account, including those of administrators. This occurs via the `POST /api/auth/user/invalidateUser` endpoint. The issue resides in `src/pages/api/auth/user/invalidateUser.ts`, where the `getServerSession` function verifies the existence of a session but fails to compare the `session.user.id` with the provided `userId` variable. By supplying a victim's `userId` and a `deviceId` that does not have a matching pair in `UserDevice`, the handler sets the target account's `isActive` variable to false. Consequently, the `src/server/auth.ts` file refuses login attempts with an account-expired message. An attacker requires a standard authenticated account and the victim's user ID, which can be gathered from member lists, UI responses, logs, or application metadata.

An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authorized to access by providing arbitrary system IDs in the request body. This can lead to the disclosure of target system names and metrics through the resulting notifications.