AIKIDO-2026-336490

TL;DR

OpenC3::Api#update_news calls authorize(permission: 'admin', ...) before it fetches the OpenC3 news feed and writes the response into the openc3_news Redis key, but a rescue Exception => e handler around that call also catches the AuthError the authorization check raises. An unauthenticated JSON-RPC caller can invoke update_news and get an HTTP 200 success response while the handler still writes to openc3_news. Because update_news is on the JSON-RPC whitelist, this is reachable from the externally exposed /openc3-api/api endpoint. The fix narrows the rescue so authorization failures return a 401.