Security: unrestricted mass-assignment on event update lets a club coordinator bypass president-only approvals and tamper with budget

[RudraDudhat2509]

Summary

PUT /api/events/:eventId writes the entire request body straight into the Event document with no field whitelist, and is only gated by an "is this unit's coordinator" check — not by what fields are being changed.

Location

• Route: backend/routes/events.js — router.put("/:eventId", isAuthenticated, isEventContact, eventsController.updateEvent)
• Controller: backend/controllers/eventControllers.js, updateEvent (around line 215-233) — const updates = req.body; ... Event.findByIdAndUpdate(eventId, updates, { new: true, runValidators: true })
• Middleware: backend/middlewares/isEventContact.js only verifies the caller's login email matches the organizing unit's contact email (i.e. that unit's CLUB_COORDINATOR account) — it says nothing about which fields on the event that contact is allowed to touch.

Impact

A CLUB_COORDINATOR — a mid-tier role, not an admin — can use this single endpoint to:

• Directly set room_requests[].status to "Approved", bypassing the dedicated PRESIDENT-only approval route (PATCH /room-requests/:requestId/status, gated by authorizeRole("PRESIDENT")) sitting right above it in the same route file.
• Directly edit budget.allocated / budget.spent on the event, bypassing the properly session-guarded, audited BudgetTransaction system entirely (no transaction record, no balance validation).
• Reassign the event to a different organizing_unit_id.
• Inject arbitrary entries into winners or participants.

Suggested fix

Whitelist the fields updateEvent is allowed to write (title, description, schedule, registration, media, etc.) and explicitly exclude budget, room_requests, organizing_unit_id, and winners — those already have (or should have) their own properly-authorized endpoints.