Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

NREL/api-umbrella

              main @ b3fbd68
            

111

Fixes

CVEs

CRITICAL

Peak severity

52.9%

Coverage

Highlights

Auth Bypass: 45 prior fixes. Scrutinize any change in this area.

src/api-umbrella/web-app/actions/admin/auth_external.lua: most-fixed (4 issues). Treat as high-risk during review.

80 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple CRUD endpoints lacked authorization checks, allowing unauthorized create/update/delete operations. Fixes added policy checks (authorized_create, authorized_update, authorize) but the pattern of missing guards across different resources suggests systemic gaps.

Auth Bypass: Role validation logic incorrectly required any single role instead of all required roles, and included an admin bypass. This was fixed in multiple implementations (Lua and JS), indicating a shared logic flaw.

Reflected XSS: Multiple admin DataTables and flash messages rendered user-controlled data without HTML escaping. Fixes added _.escape() or renderEscaped helpers, but the recurring pattern across views indicates a systemic output-encoding gap.