felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/wishlist.md

wishlist — triage (group D)

Pin: ghcr.io/cmintey/wishlist:v0.67.1. Gates: setup_gate + signup_block (/signup) + app sign-up switch closed by command.

release:cmintey/wishlist@v0.69.0 — REAL, app security fixes + Node runtime

Read the PR diffs:

• PR #818 "remove reset token exposure": in v0.67.1 src/routes/forgot-password/+page.server.ts the form action creates a reset token for ANY existing e-mail and RETURNS it in the action result (return { success: true, token }). The action runs whether or not SMTP is enabled (only the page UI hides the form). A stranger who knows/guesses a user's e-mail POSTs to /forgot-password and receives the token -> /reset-password -> account takeover (admin included). Severity: CRITICAL (my rating; no GHSA published yet). Login: none. Reachable: YES — after the setup gate opens the app is public; signup_block covers only /signup. (Read from source, not tested live.)
• PR #817 "validate list ownership on modifying APIs": any logged-in user could PATCH other users' lists/items (IDOR). Medium; login: any user.
• PR #832 admin "clear sessions" action was not implemented. Low; admin.
• Node.js Oct 2026 CVEs (base node:24-slim re-pinned, PR #829). Runtime; SvelteKit node adapter does not inflate bodies.

release:cmintey/wishlist@v0.68.0 "nodemailer v10 [SECURITY]" — NOT-A-FINDING

GHSA-6vj9-mwq6-2f5v: process-global DNS cache leaks TLS servername across multiple SMTPS transports (multi-tenant). Wishlist uses one transport; our template sets no SMTP. Fixed anyway by the target.

Fix / target

Smallest fix = TARGET: ghcr.io/cmintey/wishlist:v0.69.0 (ghcr tag exists; v prefix matches pin). Same main: yes (0). Breaking: none found (read v0.68.0, v0.69.0): entrypoint now exec node build (still runs migrate+seed+db:patch first); pnpm 12 via corepack; prisma migrations auto; manager/owner permission semantics changed (#819). Our healthcheck/command need only node + node:sqlite — still present (node:24-slim). Lane: SECURITY_FIX — urgent. Classifier note: the v0.69.0 summary is a URL fragment; it should quote the "## Security" paragraph. Hit itself is right.