[Backend] IDOR: loan-owner check compares a value to itself

[ogazboiz]

Questions or want to claim this? Say hi in the community chat: https://t.me/+DOylgFv1jyJlNzM0

Description

requireLoanOwner compares the caller key to itself instead of to the loan's owner, so any user can operate on any loan.

Component: Backend
Location: backend/src/middleware/loanAccess.ts -> requireLoanOwner
Severity: Critical

How to reproduce / find it

As one user, invoke an owner-only loan operation on another user's loan.

Expected behavior

The loan's stored owner must match the caller.

Notes for contributors

This is a logic/behavior defect, not a compile error. Please open one PR per fix that references this issue and names the file and function above.

[Clement-coder]

Hi,

I’m a full-stack software and blockchain engineer with hands-on experience delivering production-ready solutions across frontend, backend, and blockchain systems.

I’d like to take ownership of this issue. I’ve reviewed the requirements and can implement a scalable, maintainable, and well-tested solution that fully satisfies the acceptance criteria.

Ready to start immediately and keep the team updated throughout the process.

[Nabeelahh]

Hi maintainer I have thoroughly read the description to this issue and I can resolve this according to the description required ensuring it meet all the acceptance criteria kindly assign..

[Ahmedscreativeverse]

@Ahmedscreativeverse has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I can resolve can get back in no time

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ahmedscreativeverse to this issue.

[TCROWN10]

@TCROWN10 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @TCROWN10 to this issue.

[Chrisland58]

@Chrisland58 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainer I will like to work on this issue please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chrisland58 to this issue.

[Armolas]

@Armolas has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I would love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Armolas to this issue.

[samjay8]

@samjay8 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Boss, please assign.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @samjay8 to this issue.