Security: saving to an existing tree bypasses target-tree authorization #41

Reviewed develop at 87792f2c8b4990ef9fb1ec4cf0c29816211360cb.

An authenticated user with the QuickTree realm can select a target tree by request tree_id or by name and write a heading/graph items into it without checking authorization for that tree (CWE-862/CWE-639).

Evidence: target tree selected from request, existing-tree heading and graph writes, independent QuickTree realm.

The save path loads the requested tree and calls api_tree_item_save directly. It has no tree permission or ownership check before either write. In the reviewed Cacti host, that low-level helper validates numeric inputs and saves items; it does not authorize the target. By comparison, the normal tree endpoint explicitly checks is_tree_allowed before mutations. Granting the QuickTree realm therefore provides a route around a user's denied target-tree permissions.

Validation: static call-path review of the plugin and the pinned Cacti host, including the low-level helper and normal tree endpoint. This was not exercised against a live database. The issue requires QuickTree access and queued graphs; no unauthenticated access is claimed.

Apply the host's target-tree permission and editing/ownership policy before creating any heading or graph item. Enforce it for both ID and name lookup paths. A regression test should grant QuickTree access while denying the target tree and assert that no item is written.