RockteMQ-AI commented on issue #2372: URL: https://github.com/apache/rocketmq-dashboard/issues/2372#issuecomment-5332817900
**Issue Evaluation** Category: `bug` | Status: **Confirmed** The reported issue is valid. `AuthService.setUserEnabled` counts enabled administrators and then updates the target user in separate operations with no transaction or row lock. Two concurrent disable requests can both observe a count >= 2, both pass the guard, and both succeed — leaving zero enabled administrators with no recovery path through the user-management API. **Root Cause:** Classic TOCTOU race: `enabledAdminCount()` check and the subsequent update are not atomic. **Impact:** Complete admin lockout — no administrator can log in to recover. This is a critical availability issue. **Severity:** High The proposed fix (lock the admin set and perform check + update in one transaction) is correct. An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
