Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
django-commons/django-simple-history
master @ 1620375
2
Fixes
0
CVEs
MEDIUM
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
simple_history/admin.py: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The history administration views historically failed to verify whether a user possessed the required change permissions for a target object, potentially exposing historical data to unauthorized users.
Auth Bypass: Directly querying the model manager instead of filtering through the user's restricted queryset allowed users to bypass custom row-level access controls and view unauthorized records.