Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kiegroup/jbpm

              main @ d518cac
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

jbpm-audit: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inadequate verification of JAAS subjects against target user identifiers in JAASUserGroupCallbackImpl allows unauthorized users to retrieve administrative groups and bypass system permission barriers.

Deserialization of Untrusted Data: Unsafe XStream configuration on incoming JMS messages allows arbitrary class deserialization, leading to potential remote code execution.

Auth Bypass: Incorrect command routing bypassing User Command wrappers (such as routing through AddContentCommand instead of AddContentFromUserCommand) allows users to inject task content without proper identity context checks.