opencloud icon indicating copy to clipboard operation
opencloud copied to clipboard

User cache in graph service is not multi-tenant safe

Open rhafer opened this issue 3 months ago • 1 comments

Describe the bug

The graph service maintains a simple in-memory cache for looking up users by userid (https://github.com/opencloud-eu/opencloud/blob/main/services/graph/pkg/identity/cache.go#L87), that cache does currently not take the tenant-ids of the requesting and the requested user into account.

So a users from one tenant might get some information about a user from a different tenant if it gets to know the other users userid and if the user entry is already cached (because a different user looked it up before).

(Similar issues would exist for the groups cache, once we enable groups for multi-tenancy)

rhafer avatar Sep 04 '25 14:09 rhafer

Sorry got sidetracked with CI the whole week :/

dragonchaser avatar Oct 17 '25 08:10 dragonchaser