Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ever-co/ever-gauzy
develop @ fe004fe
323
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 150 prior fixes. Scrutinize any change in this area.
packages/core/src/auth/auth.service.ts: most-fixed (14 issues). Treat as high-risk during review.
263 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The vast majority of fixes add missing permission checks (e.g., @Permissions, PermissionGuard) to controllers, indicating systemic gaps in endpoint authorization.
Broken Access Control / Tenant Isolation: Multiple fixes address missing tenantId/organizationId filters in queries and writes, enabling cross-tenant data access and modification.
Privilege Escalation: Several fixes prevent users from assigning themselves privileged roles (SUPER_ADMIN) or modifying role permissions, indicating a recurring flaw in role handling.