[GH-ISSUE #1291] Unauthorised users can create topics #913

New issue

Closed

opened 2026-05-07 00:28:43 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:28:43 +02:00

Owner

Originally created by @baldrich25 on GitHub (Mar 13, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1291

🐞 Describe the bug
Unauthorised users can send a request to create a topic, the user is provided a 40301, however the topic is still created.

💻 Components impacted
ntfy server

💡 Screenshots and/or logs

🔮 Additional context
Using the builtin metrics server, you can monitor the count of topics on the server at a given time.

When sending unauthorised requests to publish to a topic, the user is provided a 4031 however the metric count still goes up, suggesting the topic is actually create on the server, the user just had no rights to join the topic.

Originally created by @baldrich25 on GitHub (Mar 13, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1291 :lady_beetle: **Describe the bug** Unauthorised users can send a request to create a topic, the user is provided a 40301, however the topic is still created. :computer: **Components impacted** ntfy server :bulb: **Screenshots and/or logs** :crystal_ball: **Additional context** Using the builtin metrics server, you can monitor the count of topics on the server at a given time. When sending unauthorised requests to publish to a topic, the user is provided a 4031 however the metric count still goes up, suggesting the topic is actually create on the server, the user just had no rights to join the topic.

BreizhHardware

2026-05-07 00:28:43 +02:00

closed this issue
added the
🪲 bug
label

BreizhHardware commented

2026-05-07 00:28:43 +02:00

Author

Owner

@binwiederhier commented on GitHub (Aug 11, 2025):

I suppose that this is technically correct (the best kind of correct), but it's effectively just semantics. Topics are ephemeral and are held in memory in a map (https://github.com/binwiederhier/ntfy/blob/main/server/server.go#L53), and topics are removed regularly if nobody accesses them: https://github.com/binwiederhier/ntfy/blob/main/server/server_manager.go#L38-L52.

So yes, when somebody tries to access a topic, it is created in memory, but since nobody can publish to it, it'll eventually be removed.

While technically correct, it's not worth fixing

@binwiederhier commented on GitHub (Aug 11, 2025): I suppose that this is technically correct (the best kind of correct), but it's effectively just semantics. Topics are ephemeral and are held in memory in a map (https://github.com/binwiederhier/ntfy/blob/main/server/server.go#L53), and topics are removed regularly if nobody accesses them: https://github.com/binwiederhier/ntfy/blob/main/server/server_manager.go#L38-L52. So yes, when somebody tries to access a topic, it is created in memory, but since nobody can publish to it, it'll eventually be removed. While technically correct, it's not worth fixing