From f57ca09f6ea7b02efbec0549bf1960b9ba5de427 Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Thu, 5 Nov 2026 17:50:21 -0600
Subject: [PATCH] Update session middleware to check session userId with
 current user

---
 server/controllers/SessionController.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server/controllers/SessionController.js b/server/controllers/SessionController.js
index 7cc8d35e2..d842089c7 100644
--- a/server/controllers/SessionController.js
+++ b/server/controllers/SessionController.js
@@ -361,6 +361,11 @@ class SessionController {
       return res.sendStatus(404)
     }
 
+    if (playbackSession.userId !== req.user.id && !req.user.isAdminOrUp) {
+      Logger.error(`[SessionController] Non-admin user "${req.user.username}" attempted to access session belonging to another user "${req.params.id}"`)
+      return res.sendStatus(403)
+    }
+
     if (req.method == 'DELETE' && !req.user.canDelete) {
       Logger.warn(`[SessionController] User "${req.user.username}" attempted to delete without permission`)
       return res.sendStatus(403)