Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
exadel-inc/compreface
master @ ddf32da
24
Fixes
0
CVEs
HIGH
Peak severity
75.0%
Coverage
Highlights
Auth Bypass: 15 prior fixes. Scrutinize any change in this area.
admin/src/main/java/com/exadel/frs/system/security/AuthorizationManager.java: most-fixed (4 issues). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inconsistent privilege verification checks previously allowed lower-privileged users (App Administrators or standard users) to bypass write restrictions, delete application roles, or self-remove without authorization. Developers must consistently use strict permission checks when dealing with application-level and organization-level resources.
Unrestricted File Upload: The proxy controller failed to validate file extensions during image uploads, permitting unrestricted file uploads. Developers must enforce strict allowlist validation of file extensions on all multipart file uploads.
Auth Bypass: Weaknesses in API key parsing and filter checks allowed requests missing headers or containing malformed API keys (e.g., bypassing app/model split validation) to slip past core recognition and training endpoints.