Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/casbin

              master @ f64a3c0
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

Enforcer: most-fixed (3 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flawed domain verification and incorrect role-link evaluation within HasLink when custom matching functions and domain patterns are active allow cross-domain authorization bypasses.

Arbitrary Code Execution: A dangerous GitHub Actions workflow triggered on pull_request_target checked out untrusted pull request code and ran tests with write permissions, presenting an immediate remote code execution vector.

Auth Bypass: Stale cached g() function evaluations within BuildRoleLinks allowed outdated and incorrect permissions to persist after policy rules were modified at runtime.