Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

LibrePhotos/librephotos

              dev @ 2591afa
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

apps/backend/api/views/photos.py: most-fixed (6 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Broken Access Control / IDOR: Multiple bulk operations (makepublic, hide/unhide, trash, favorite) lacked owner scoping, allowing cross-user modification of photos.

Auth Bypass / Privilege Escalation: Upload endpoints trusted user-supplied 'user' POST parameter, and user creation allowed non-admins to create superusers.

Authorization Bypass / IDOR: Operator-precedence bug in Q-filter allowed cross-user photo deletion; job list endpoint allowed non-staff to view other users' jobs.