Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apache/isis
main @ 4326c77
101
Fixes
2
CVEs
CRITICAL
Peak severity
22.5%
Coverage
Highlights
Auth Bypass: 69 prior fixes. Scrutinize any change in this area.
core/metamodel: most-fixed (6 issues). Treat as high-risk during review.
56 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Precedence rules and incorrect evaluation of authorization facets against mixin instances rather than the underlying domain objects have historically allowed unauthorized access to domain members. Ensuring authorization-derived hidden facets are registered with high precedence is critical to prevent visibility leaks.
Deserialization of Untrusted Data: Untrusted viewmodel states and bookmarks were previously deserialized without cryptographic signing, leading to potential arbitrary code execution. Serialization pathways must be guarded with HMAC signing and verification.
Auth Bypass: Refinement of user metadata in SecMan historically discarded original roles or failed to copy the user's database roles during accumulation, resulting in complete bypasses of downstream role-based authorization.