Unauthenticated access to dashboard parameter values when Public Sharing is disabled

Overview

When "Enable Public Sharing" is disabled in Admin settings, four endpoints under GET /api/public/ continue to return data without authentication for cards or dashboards that were previously shared publicly. While the primary public dashboard routes correctly respond with 400 when public sharing is disabled, these endpoints are not subject to the same access control check, resulting in inconsistent enforcement.

Affected endpoints:

• GET /api/public/card/{uuid}/params/{param-key}/remapping
• GET /api/public/dashboard/{uuid}/params/{param-key}/values
• GET /api/public/dashboard/{uuid}/params/{param-key}/search/{query}
• GET /api/public/dashboard/{uuid}/params/{param-key}/remapping

Note: This issue only affects cards or dashboards that were previously shared publicly and later had sharing revoked. Dashboards that were never shared publicly are not affected.

Impact

Unauthenticated users can retrieve potentially private information even after public sharing is disabled.
Depending on dashboard configuration, this may expose sensitive business data - including financial metrics or other dataset attributes - to unauthorized parties.

Patches

The same public-sharing validation logic used by the primary public dashboard routes was applied to all 4 endpoints above.

The fix is available in the following versions and above:

• 0.54.21, 1.54.21
• 0.55.21, 1.55.21
• 0.56.21, 1.56.21
• 0.57.14, 1.57.14
• 0.58.8, 1.58.8
• 0.59.1, 1.59.1

Credit

Reported b…