Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

SuiteCRM/SuiteCRM-Core

              hotfix @ 6c7ce00
            

Fixes

CVEs

CRITICAL

Peak severity

21.1%

Coverage

Highlights

Auth Bypass: 16 prior fixes. Scrutinize any change in this area.

config/packages/security.php: most-fixed (3 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: OAuth2 token issuance and client validation were repeatedly bypassed, allowing disabled users or invalid clients to obtain tokens. The fixes add user-enabled and secret/grant-type checks, but sibling token endpoints or custom grants may still skip them.

Auth Bypass: Legacy session initialization and validation were bypassed, allowing unauthent or TOTF-incomplete users to access APIs. The fixes add conditional session init and session validity checks, but alternate login flows or session restore paths may not enforce them.

Authorization Bypass: ACL checks on UI actions and route guards were bypassed, allowing unauthorized access to records or modules. The fixes add ownership context and improved route parsing, but other UI components or routes may still rely on incomplete ACL checks.