SECUREDROP = 0.3 – Possible Backdoor and Privileges Escalation by Unauth User

Relevant portion of the rant:<p><pre><code> File &#x2F;securedrop&#x2F;journalist.py, lines 125-128, missing @admin_required decorator 125 @app.route(&#x27;&#x2F;admin&#x2F;add&#x27;, methods=3D(&#x27;GET&#x27;, &#x27;POST&#x27;)) 126 def admin_add_user(): 127 # TODO: process form submission 128 return render_template(&quot;admin_add_user.html&quot;) </code></pre> Ouch!