From 68b1dc201a31c916cc9ba97986b29ddff67d9e98 Mon Sep 17 00:00:00 2001 From: felhom security watch Date: Mon, 9 Nov 2026 03:44:09 +0000 Subject: [PATCH] security-watch: memory of 2026-11-09 (R-1303). Docs only. --- documentation/security-watch/state.json | 210 ++++++++++++------------ 1 file changed, 105 insertions(+), 105 deletions(-) diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index 449184fc..ea39d31c 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -106,7 +106,7 @@ }, "dooplex:actualbudget/actual-server|GHSA-p7p2-pm6f-rg6x": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", "summary": "Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection" }, @@ -214,13 +214,13 @@ }, "dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)", "summary": "1 introduces important security fixes" }, "dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)", "summary": "1 introduces important security fixes" }, @@ -431,7 +431,7 @@ }, "dooplex:gitea/gitea|GHSA-32h8-5xqg-h466": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Actions: fork workflow gets secrets and write token via review commit_id" }, @@ -443,13 +443,13 @@ }, "dooplex:gitea/gitea|GHSA-37xv-m4w7-j2fh": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only tokens bypass private-resource restrictions on the admin API" }, "dooplex:gitea/gitea|GHSA-3fv3-hhmm-4x2q": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-" }, @@ -544,7 +544,7 @@ }, "dooplex:gitea/gitea|GHSA-5j4v-rwqr-vpq7": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea web profile and feed routes bypass public-only token scope for limited-visibility users" }, @@ -606,7 +606,7 @@ }, "dooplex:gitea/gitea|GHSA-6h2f-c8jm-84hc": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)" }, @@ -670,7 +670,7 @@ }, "dooplex:gitea/gitea|GHSA-8g99-g36h-5p2w": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only package tokens can access private OCI blobs" }, @@ -690,7 +690,7 @@ }, "dooplex:gitea/gitea|GHSA-8p3x-w464-4g6v": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username" }, @@ -709,7 +709,7 @@ }, "dooplex:gitea/gitea|GHSA-8r36-6j2c-3gmv": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos" }, @@ -785,7 +785,7 @@ }, "dooplex:gitea/gitea|GHSA-9v6p-xpcp-7488": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header" }, @@ -798,7 +798,7 @@ }, "dooplex:gitea/gitea|GHSA-c45m-jm46-mwxg": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public project boards disclose private pull request titles and repository names" }, @@ -967,7 +967,7 @@ }, "dooplex:gitea/gitea|GHSA-jr76-w9m3-3p68": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds " }, @@ -1004,7 +1004,7 @@ }, "dooplex:gitea/gitea|GHSA-mf6p-vqpw-3r7x": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Actions token can spoof instance-signed commits by adding a GPG key" }, @@ -1043,7 +1043,7 @@ }, "dooplex:gitea/gitea|GHSA-p86q-78gw-8f3f": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDep" }, @@ -1092,7 +1092,7 @@ }, "dooplex:gitea/gitea|GHSA-q9gm-9c7q-c5hq": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)" }, @@ -1104,13 +1104,13 @@ }, "dooplex:gitea/gitea|GHSA-qcgm-ggp8-22qc": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only PAT scope bypass via Actions runner registration leaks private repository secrets" }, "dooplex:gitea/gitea|GHSA-r6mh-qg79-rqj2": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)" }, @@ -1178,7 +1178,7 @@ }, "dooplex:gitea/gitea|GHSA-vmrc-8q2x-573x": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "API Issue Mutation Archive Restriction Bypass" }, @@ -1246,7 +1246,7 @@ }, "dooplex:gitea/gitea|GHSA-wxcq-p34j-7cjj": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only tokens expose private repositories through profile and organization tabs" }, @@ -1258,7 +1258,7 @@ }, "dooplex:gitea/gitea|GHSA-x5v4-836g-f95x": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories" }, @@ -1428,13 +1428,13 @@ }, "dooplex:louislam/uptime-kuma|GHSA-v2p3-6f5h-6hhf": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)" }, "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", "summary": "⬆️ Security Fixes" }, @@ -1481,7 +1481,7 @@ }, "dooplex:outlinewiki/outline|release:outline/outline@v1.12.0": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "outlinewiki/outline 1.10.1 (outline)", "summary": "1 which fixes multiple recently disclosed vulnerabilities" }, @@ -1565,7 +1565,7 @@ }, "dooplex:rommapp/romm|release:rommapp/romm@5.4.1": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "rommapp/romm 5.3.1 (romm)", "summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible" }, @@ -1577,13 +1577,13 @@ }, "dooplex:vaultwarden/server|GHSA-9pjj-f9g5-3x4c": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)", "summary": "Emergency access [GHSA-9pjj-f9g5-3x4c] ( Medium , 4" }, "dooplex:vaultwarden/server|GHSA-x9cq-f669-vrr4": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)", "summary": "Website icons [GHSA-x9cq-f669-vrr4] ( Medium , 5" }, @@ -1697,13 +1697,13 @@ }, "getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "getmeili/meilisearch v1.36.0 (wanderer)", "summary": "1 introduces important security fixes" }, "getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": { "first": "2026-11-02", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "getmeili/meilisearch v1.36.0 (wanderer)", "summary": "1 introduces important security fixes" }, @@ -1844,61 +1844,61 @@ }, "gtstef/filebrowser|GHSA-26fh-r34c-qxh6": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Moving or renaming a folder retargets public shares to the whole folder" }, "gtstef/filebrowser|GHSA-3846-gh75-gp3m": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)" }, "gtstef/filebrowser|GHSA-3j46-5w28-f8p2": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write" }, "gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Duplicate finder can show another user’s restricted file names from a shared cache" }, "gtstef/filebrowser|GHSA-4v62-884x-2466": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback" }, "gtstef/filebrowser|GHSA-4vrc-935w-xxq2": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical" }, "gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`" }, "gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting" }, "gtstef/filebrowser|GHSA-6gr6-5qpq-888p": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum" }, "gtstef/filebrowser|GHSA-8655-2ph3-q7q7": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled" }, @@ -1910,145 +1910,145 @@ }, "gtstef/filebrowser|GHSA-8m35-wcjh-95q7": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Logout Bypass via Alternate JWT Spelling" }, "gtstef/filebrowser|GHSA-9fcr-gm58-p839": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors" }, "gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer" }, "gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Read-only users can overwrite files through PUT /api/resources" }, "gtstef/filebrowser|GHSA-c84q-q5g6-r47f": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)" }, "gtstef/filebrowser|GHSA-c9cr-w724-gqj3": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin" }, "gtstef/filebrowser|GHSA-cw65-p35p-633w": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)" }, "gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)" }, "gtstef/filebrowser|GHSA-gfgm-886h-6r47": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Custom API token with no global caps inherits owner admin access" }, "gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory" }, "gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions" }, "gtstef/filebrowser|GHSA-p93p-v944-4p44": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission" }, "gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS" }, "gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Archive download follows symlinks out of source scope (arbitrary file read)" }, "gtstef/filebrowser|GHSA-qv53-4557-m65h": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key" }, "gtstef/filebrowser|GHSA-qx86-4v5r-26g5": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)" }, "gtstef/filebrowser|GHSA-r744-4vm3-2px3": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas" }, "gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN" }, "gtstef/filebrowser|GHSA-rqqq-wv83-rp74": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope" }, "gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": { "first": "2026-10-26", - "last_mailed": "2026-11-02", + "last_mailed": "2026-11-09", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": " Stored XSS via HTML Preview — `