Possible bug?: Able to access app ingress as normal user despite panel_admin being set to true

Configuration
1

Hi, I’m new to HA and am trying to make my own app, and I notices something odd. I think this might be a bug/security flaw in HA but I wanted to check with others before filing a bug report. As the title says, I’m able to access an apps ingress page as a normal user despite panel_admin being set to true in config.yaml.

It’s pretty easy to test for yourself;

  1. Get a fresh HA install
  • (I used Ras Pi Imager and selected the HA os)
  1. Setup “admin” person & account in Administrators group during initial setup
  2. Go to apps and install Terminal & SSH, start the app and enable “Show in sidebar”
  • (Terminal & SSH does not have panel_admin in its config.yaml , which according to the docs means it defaults to true )
  1. Click “Open Web UI” and copy the url
  2. Add a new “user” person & account in Users group
  3. Logout of the “admin” account & login to the “user” account
  4. Past the copied url into your browser

And then you’re a normal user with root access in the Terminal & SSH app… so yea, was not expecting that. The sidebar url http://homeassistant.local/core_ssh redirects to your default dashboard correctly, but the “Open Web UI” url http://homeassistant.local/app/core_ssh still works after manually typing/pasting it in.

Is this a bug? Security issue? Intended behavior? Is this already known or did I discover something new? Just wanted to get other perspectives from more experienced users before opening an issue on GitHub. Is there already an existing issue open?

2

Home Assistant does not have a local security model. It has been in the “too hard” basket for years.

Assume nothing is secure if someone has access to your dashboard.

You can hide things but that does not mean they can’t be accessed by a determined person.

3

Embarassed to bring you sad news. Welcome to the ‘security by obscurity’ model. That security access granularity feature you expect is highly desirable, but the design to implement it is in the product change request, not bug fix category. I expect this will be a significant rewrite taking months/years rather than next weeks quick patch. It is a fundamental design strategy issue, rather than a software bug, borne of historic open source origins.
Revise your development strategy accordingly - just expect everybody to have access to your database if you continue to use this platform.