NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware() protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.canwrite(), not role.canadmin(). tokenspage() and tokenslist() call store.listalltokens(), exposing IDs and metadata across all users, while tokensrevoke() calls store.revoketoken using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.