CVE-2020-15877: Exposure of Resource to Wrong Sphere in LibreNMS

The vulnerability stems from improper access control in route definitions. The commit diff shows a critical change in routes/web.php where authorization middleware was incorrectly implemented using 'guard' => 'admin' instead of the proper 'middleware' => ['can:admin']. In Laravel, 'guard' controls authentication (who you are) while 'middleware'/'can:' controls authorization (what you're allowed to do). This misconfiguration allowed normal users to access admin-only routes through session persistence, as it only checked authentication realm rather than actual permissions.