3.1 KiB
Picks for the operator — flaws with no fix inside the main version (2026-10-27)
No template was changed for any of these. Each pick: the question, CC's pick first, the cost of the other, and what happens if nobody decides. Fleet fact for all of them (hub 2026-10-27): no box runs any of these apps; the risk is a NEW install.
1. SparkyFitness — two notices, no fix released (GHSA-p8cf-g8rv-gvrq, GHSA-cmmf-53wf-r5gv)
What a stranger can do with our template: nothing without an account or a leaked photo URL. p8cf needs a household
account (it overwrites another member's Withings link); cmmf needs the exact URL of an owner-only photo. A third notice
(GHSA-v883) does not apply: our template generates BETTER_AUTH_SECRET per install.
- A (CC's pick): leave it offered and wait for the upstream fix, then take it with R-785's big step (0.17 → 1.x). Cost: a family that installs it meanwhile carries two medium flaws that need one of its own accounts.
- B: hide it from new installs (
lifecycle: hidden) until a fixed version is proven. Cost: the app disappears from the catalog for an unknown time. - If you do nothing: A.
2. Gitea — GHSA-rqhx-647v-wx32: SSRF through a redirect in repository migration (the upstream patch was reverted)
What a stranger can do: nothing without an account (sign-up is closed twice in our template). A household account can make the box fetch an internal address through „New migration".
- A (CC's pick): leave migrations on, and judge it again in Gitea's big step (1.27.3 → 28.2.0, which fixes 40 other notices). Cost: a signed-in household member can reach the home network through the migration form.
- B: turn migrations off (
GITEA__repository__DISABLE_MIGRATIONS=true). Cost: the household cannot import a repository from GitHub any more. - If you do nothing: A.
3. Termix — GHSA-7j7m-85p4-2cpm: a stranger skips the login rate limit with a forged X-Forwarded-For (R-1311)
The fix is Termix's big step (2.8 → 2.9.2 → 26.10.5, two hops).
- A (CC's pick): wait for the big step. Cost: until then, a stranger can guess passwords faster than the limit means.
- B: strip the header in the template now (as docmost and paperless do, R-753). Cost: every visitor then shares the tunnel's one address, so a stranger's wrong guesses can lock the household out of the login (the Grimmory shape, R-775).
- If you do nothing: A.
4. The big steps a stranger can use before they are done (Wanderer, Jellyfin, Gitea, Termix)
Wanderer's critical notice (GHSA-fprh-3pp9-68m9: any remote ActivityPub server overwrites records, no login, federation has no off switch) is the worst open item. Jellyfin (GHSA-hw73, a file read with no login), Gitea (two notices with no login) and Termix (above) follow.
- A (CC's pick): hide Wanderer from new installs (
lifecycle: hidden) until its big step (v0.21.2) is proven; leave the others offered. Cost: Wanderer leaves the catalog for the days its step takes. - B: leave all four offered. Cost: a new Wanderer install is open to any federated server from its first day.
- If you do nothing: B.