Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
grails/grails-data-mapping
9.0.x @ 6b51cac
14
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 14 prior fixes. Scrutinize any change in this area.
grails-datastore-gorm: most-fixed (3 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Dynamic finder methods (like findBy*) were historically cached on the persistent class's metaclass statically, which bypassed tenant isolation on subsequent calls by executing queries outside of the active tenant context.
Auth Bypass: Hibernate list queries using pagination parameters like 'max' lost their tenant ID resolution when executing paged list operations, exposing database records across tenants.
Auth Bypass: Exiting nested withTenant blocks cleared the active tenant context entirely instead of restoring the previous tenant ID, leading to context bleeding and unauthorized data access.