Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

FOGProject/fogproject

              stable @ 9f3b5a8
            

116

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 50 prior fixes. Scrutinize any change in this area.

packages/web/lib/plugins/ldap/class/ldap.class.php: most-fixed (17 issues). Treat as high-risk during review.

93 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The largest cluster of fixes targets LDAP authentication, with repeated bypasses via bind DN format, filter construction, user object handling, and account-disabled checks. Multiple fixes were reverted or re-applied, indicating a fragile, high-churn surface.

Auth Bypass: Core login and boot-menu paths had multiple bypasses via missing null checks, weak type validation, and pre-auth hook manipulation. Fixes repeatedly add isValid()/type checks and reorder hooks, indicating a need for a single, enforced authentication gate.

Auth Bypass: API and route dispatch lacked authorization checks, allowing any API-enabled account to reach admin functions. Fixes added class allowlists and token/basic-auth gates, but the breadth suggests other endpoints may still miss these checks.