Broken Access Control on DELETE Endpoint

The merged_router is registered with a read-access guard at main.py:80, but the router contains a DELETE endpoint that performs a destructive write operation. No endpoint-level authorization override restricts this to write-privileged users.

router.include_router(merged_router, dependencies=[Depends(has_read_access)])

The DELETE endpoint at merged/main.py:64 inherits the read-only guard with no override:

@router.delete(
    "/merged-item/{identifier}", status_code=status.HTTP_204_NO_CONTENT, tags=["editor"]
)
def delete_merged_item(
    identifier: Annotated[Identifier, Path()],
    include_rule_set: Annotated[bool, Query(...)] = False,
) -> None:

The has_read_access guard verifies only that credentials exist in the read or write database. It does not check for write-level authorization or differentiate by HTTP method:

if api_key:
    api_key_database = settings.backend_api_key_database
    can_read = APIKey(api_key) in api_key_database.read

Deletion cascades: a single DELETE request removes the merged item, all linked extracted items (from multiple ETL pipelines), all rule-sets, and all nested objects (Text, Link). There is no soft-delete or undo mechanism. Recovery requires re-ingestion from all source ETL pipelines.

By contrast, write operations on the ingest_router at main.py:77 correctly use Depends(has_write_access) and return 403 for read-only keys.

The same vulnerability exists in the testing application at testing/main.py:48.

The DELETE endpoint was introduced in v1.2.0 (2025-10-23). The merged_router has been registered with has_read_access since the router was created.

The MEx Editor currently uses a shared write-level API key for all backend requests regardless of user role, masking this vulnerability in practice. However, the editor codebase contains a TODO (MX-1616) for switching to per-user backend credentials. Once that migration is implemented, the backend's missing authorization on DELETE will become directly exploitable through the editor for any authenticated user.