2.1 KiB
tandoor — triage (group C, 2026-10-27)
Pin: ghcr.io/tandoorrecipes/recipes:2.6.15 (+ postgres:17-alpine). setup_gate; no signup_block (ENABLE_SIGNUP not set = upstream default off); household added by invite link. Health probe and compose healthcheck use /accounts/login/.
Notices (9 + 1 release hit)
NOT-A-FINDING (1): GHSA-cqj3-64qw-4w52 — fixed in 2.6.10 (release note links it), below our pin; range field unreadable. REAL (8), all named as fixed in the 2.7.0 release notes: GHSA-5f74 (high, XXE local file read in rezeptsuite/Cookmate importers + pestle SSRF), GHSA-69q3 (high, group-permission cache across spaces), GHSA-5p9v, pcq2, xq7g, 748x, c7mc, vc5c (medium). release:2.7.0 = the same real fixes (+ "lots of dependencies, several security issues"). Login: any user (import permission / same space). Reachable: household accounts only (setup gate, no public sign-up). 5f74 can read container files (env holds SECRET_KEY, DB password) for any household user. Worst real: high.
Fix
Smallest: 2.7.0. TARGET: 2.7.2 (ghcr tags 2.7.0/2.7.1/2.7.2, no v). Same main: yes. Breaking (read 2.7.0, 2.7.1, 2.7.2): 2.7.0 migrated all auth views to the new frontend; REMOVED settings SOCIALACCOUNT_ONLY, SOCIALACCOUNT_LOGIN_ON_GET, SOCIALACCOUNT_AUTO_SIGNUP (none in our compose); REMOVED api-token-auth/ endpoint; new ACCOUNT_EMAIL_VERIFICATION default "optional"; ENABLE_SIGNUP also blocks social sign-up. 2.7.0/2.7.1 broke invite links on instances with sign-up disabled (fixed 2.7.2: "InviteLinks not working on pages with disabled signup") — our household path, so 2.7.0/2.7.1 must be skipped. Lane: strict reading BIG_STEP (removed settings + removed endpoint + rewritten login pages). The operator could rule it SECURITY_FIX: none of the removed settings is in our compose. Do this only after a bench walk proves /accounts/login/ still answers (probe + healthcheck) and an invite link works on 2.7.2 — unsure until measured.
Classifier note
The watch matched only GHSA-5p9v in the 2.7.0 notes; the same body names 8 of our GHSAs — match every GHSA id in the body. cqj3: check release notes below the pin before flagging an unreadable range.