3.2 KiB
Picks for the operator — flaws with no fix inside the main version (2026-10-27)
No template was changed for any of these. Each pick: the question, CC's pick first, the cost of the other, and what happens if nobody decides. Fleet fact for all of them (hub 2026-10-27): no box runs any of these apps; the risk is a NEW install.
1. SparkyFitness (STATUS D56) — two notices, no fix released (GHSA-p8cf-g8rv-gvrq, GHSA-cmmf-53wf-r5gv)
What a stranger can do with our template: nothing without an account or a leaked photo URL. p8cf needs a household
account (it overwrites another member's Withings link); cmmf needs the exact URL of an owner-only photo. A third notice
(GHSA-v883) does not apply: our template generates BETTER_AUTH_SECRET per install.
- A (CC's pick): leave it offered and wait for the upstream fix, then take it with R-785's big step (0.17 → 1.x). Cost: a family that installs it meanwhile carries two medium flaws that need one of its own accounts.
- B: hide it from new installs (
lifecycle: hidden) until a fixed version is proven. Cost: the app disappears from the catalog for an unknown time. - If you do nothing: A.
2. Gitea (STATUS D57) — GHSA-rqhx-647v-wx32: SSRF through a redirect in repository migration (the upstream patch was reverted)
What a stranger can do: nothing without an account (sign-up is closed twice in our template). A household account can make the box fetch an internal address through „New migration".
- A (CC's pick): leave migrations on, and judge it again in Gitea's big step (1.27.3 → 28.2.0, which fixes 40 other notices). Cost: a signed-in household member can reach the home network through the migration form.
- B: turn migrations off (
GITEA__repository__DISABLE_MIGRATIONS=true). Cost: the household cannot import a repository from GitHub any more. - If you do nothing: A.
3. Termix (STATUS D58) — GHSA-7j7m-85p4-2cpm: a stranger skips the login rate limit with a forged X-Forwarded-For (R-1311)
The fix is Termix's big step (2.8 → 2.9.2 → 26.10.5, two hops).
- A (CC's pick): wait for the big step. Cost: until then, a stranger can guess passwords faster than the limit means.
- B: strip the header in the template now (as docmost and paperless do, R-753). Cost: every visitor then shares the tunnel's one address, so a stranger's wrong guesses can lock the household out of the login (the Grimmory shape, R-775).
- If you do nothing: A.
4. The big steps (STATUS D59) a stranger can use before they are done (Wanderer, Jellyfin, Gitea, Termix)
(Jellyfin's big step went LIVE the same day, catalog 540f185, so this pick is now about Wanderer alone.) Wanderer's critical notice (GHSA-fprh-3pp9-68m9: any remote ActivityPub server overwrites records, no login, federation
has no off switch) is the worst open item. Jellyfin (GHSA-hw73, a file read with no login), Gitea (two notices with no
login) and Termix (above) follow.
- A (CC's pick): hide Wanderer from new installs (
lifecycle: hidden) until its big step (v0.21.2) is proven; leave the others offered. Cost: Wanderer leaves the catalog for the days its step takes. - B: leave all four offered. Cost: a new Wanderer install is open to any federated server from its first day.
- If you do nothing: B.