Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tencentblueking/bk-cmdb

              master @ 111e7ac
            

215

Fixes

CVEs

CRITICAL

Peak severity

25.6%

Coverage

Highlights

Auth Bypass: 166 prior fixes. Scrutinize any change in this area.

src/auth/parser/topology.go: most-fixed (26 issues). Treat as high-risk during review.

144 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecure routing regular expressions, incomplete business ID context bindings, and incorrect HTTP method matching on topology patterns consistently allowed unauthorized modification and deletion of object property groups.

Auth Bypass: Failure to propagate errors during business ID extraction from metadata in `topolatest.go` permitted execution of operations under improper authorization scopes.

Auth Bypass: Queries executed via `m.dbProxy` lacked systematic enforcement of the caller's supplier account owner, bypassing multi-tenant isolation.