Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
micropyramid/django-crm
master @ d960833
9
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Broken Access Control: 2 prior fixes. Scrutinize any change in this area.
backend/common/views/auth_views.py: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Broken Access Control: The application failed to enforce user-scoped filtering on critical records like Leads and Contacts, allowing authenticated users to retrieve or modify assets belonging to other users. Future form modifications must explicitly filter queries by the authenticated user request context.
Auth Bypass: A password change view (change_pass) previously permitted changing user passwords without validating the current active password, creating a massive risk of account takeover if a session was briefly hijacked.
Broken Access Control: A lack of explicit organization-scoped filtering in Comment querysets allowed cross-tenant data leakage where users could view comments belonging to distinct organizations.