From 11c3546d105dcf6dfd12a416dcf517199d7b0b3e Mon Sep 17 00:00:00 2001 From: Kabir Date: Fri, 31 Jul 2026 13:04:40 +0530 Subject: [PATCH] Fix: Restrict /api/users/search to admin role to prevent PII leak (Issue #449) --- app/api/users/search/route.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/api/users/search/route.ts b/app/api/users/search/route.ts index 6890c838..c959b177 100644 --- a/app/api/users/search/route.ts +++ b/app/api/users/search/route.ts @@ -12,7 +12,7 @@ interface SearchResult { // GET /api/users/search?q=query — search users by name or email export async function GET(request: NextRequest) { - const user = await requireAuth(request, 'adventurer', 'admin'); + const user = await requireAuth(request, 'admin'); if (!user) return NextResponse.json({ error: 'Unauthorized', success: false }, { status: 401 }); const { searchParams } = new URL(request.url);