Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tolgee/tolgee-platform
main @ b4b3bb7
70
Fixes
0
CVEs
CRITICAL
Peak severity
28.2%
Coverage
Highlights
Auth Bypass: 43 prior fixes. Scrutinize any change in this area.
backend/data/src/main/kotlin/io/tolgee/service/security/SignUpService.kt: most-fixed (3 issues). Treat as high-risk during review.
38 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Bypasses in the internal request filter allowed unauthenticated external access to highly dangerous internal endpoints that could execute arbitrary native SQL queries.
SSRF: Incomplete validation of user-configurable URLs in SSO tenant setup and Webhook configurations allowed targeting internal infrastructure and local address spaces.
Auth Bypass: Third-party OAuth flows and forced SSO signups bypassed standard user registration configurations, permitting signups even when registration was disabled.