Data from a cloud account has been loaded into another person's task data.

[Erwin11]

App Version

3.28.1

API Provider

DeepSeek

Model Used

DeepSeek v3.1

Roo Code Task Links (Optional)

open Roo code cloud
and saw another person's task.
thanks god I can't open it

🔁 Steps to Reproduce

💥 Outcome Summary

I should only be able to see my own data.

📄 Relevant Logs or Errors (Optional)

[roomote]

I'm exploring a potential fix for this critical data privacy issue and will open a PR to share progress. This appears to be a serious security concern where user task data is being incorrectly shared across accounts.

[roomote]

I've implemented client-side validation to help prevent this issue, but I have some questions about the server-side requirements before creating the PR:

The critical fix for this data privacy issue requires server-side validation to ensure users can only access their own tasks. My current implementation:

1. ✅ Adds userId to TaskChannel for ownership validation
2. ✅ Includes userId in task JOIN requests
3. ✅ Passes userId from BridgeOrchestrator to TaskChannel
4. ✅ Adds comprehensive tests for user isolation

However, the server-side validation is the critical piece that's missing. The server needs to:

• Verify the authenticated user (from session token) owns the requested task
• Reject JOIN requests for tasks the user doesn't own
• Ensure task queries are properly scoped to the authenticated user

Could you help clarify:

1. Is there an existing server-side task ownership validation mechanism I should integrate with?
2. Should the server validate ownership in the WebSocket JOIN handler or through a separate API endpoint?
3. Are there specific error codes/messages the server should return for unauthorized access attempts?

I have the client-side changes ready in branch fix/issue-7932-task-data-isolation but want to ensure the complete fix addresses the root cause before submitting the PR.

[roomote]

Opened PR #7933 with client-side validation improvements to help address this issue: #7933

This PR adds an important layer of defense by:

• Including user ID in task subscription requests
• Preparing the client to work with server-side validation
• Adding comprehensive tests for user isolation

However, as noted in the PR and my previous comment, server-side validation is still critical for complete security. The PR clearly documents what server-side changes are needed to fully resolve this data privacy issue.

The client-side changes are ready for review and will work seamlessly once the server-side validation is implemented.

[Erwin11]

I have recorded the entire process in a video and sent it to security@roocode.com via email.

[mrubens]

Thank you for reporting this @Erwin11. We've disabled the feature while we investigate and will handle this through our security process.