Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
vulcanjs/vulcan
devel @ 5b81976
89
Fixes
1
CVEs
HIGH
Peak severity
42.9%
Coverage
Highlights
Auth Bypass: 45 prior fixes. Scrutinize any change in this area.
packages/vulcan-users/lib/modules/permissions.js: most-fixed (7 issues). Treat as high-risk during review.
51 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical flaw in ownership verification logic (Users.owns) where username/slug comparisons on arbitrary documents allowed users to bypass document-ownership validation. Normalizing permissions was also historically vulnerable to case-sensitivity bypasses and incorrect nested-array checking logic.
Information Disclosure: Leakage of bcrypt password hashes to the client (CVE-2015-3454) and overall failure to filter sensitive fields in user profile publications to non-admin subscribers.
Mass Assignment: Failure to validate client-supplied Mongo modifiers on schemas allowed non-privileged users to modify restricted fields such as post ownership or parent comments without correct permission scoping.