Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

grimmory-tools/grimmory

              develop @ 8362a90
            

Fixes

CVEs

CRITICAL

Peak severity

38.9%

Coverage

Highlights

Auth Bypass: 22 prior fixes. Scrutinize any change in this area.

SecurityConfig.java: most-fixed (6 issues). Treat as high-risk during review.

32 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes to security configuration show a pattern of overly broad permitAll rules and misconfigured filter chains, leading to unauthenticated access to sensitive endpoints. The critical fix (9ddbe357) scoped filters to specific routes, but sibling fixes (4d6691ef, 0e808df1, 03ce268d) show that permitAll lists were repeatedly expanded incorrectly, indicating a high risk of future misconfiguration.

Auth Bypass: Authorization bypasses were fixed by adding @CheckBookAccess and @PreAuthorize annotations across many controllers, but the fixes are spread across multiple commits (145b94df, 0c23424f, 15007143, e0dec6f2, 78b05cab), indicating that many endpoints initially lacked these guards. The risk is that new endpoints or sub-paths may still miss these annotations, especially in reader, metadata, and font management features.

SSRF: SSRF protections were added in multiple fixes (1682a98d, 31b574d3, 26497ca7, 073bc104) but the fixes show a history of incomplete or broken implementations, such as allowing unsafe hosts via opt-in and using a custom request factory that permitted Host header rewriting. The risk is that outbound HTTP requests from other components (e.g., OIDC, file fetching) may not consistently apply the InetAddressFilter or Host header checks.