Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

homarr-labs/homarr

              dev @ b6dfcd6
            

Fixes

CVEs

HIGH

Peak severity

21.4%

Coverage

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

apps/nextjs/src/app/api/user-medias/[id]/route.ts: most-fixed (2 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring missing authorization checks on API endpoints, especially integration listing, app pagination, notebook updates, and board access. Multiple fixes add permission checks that were previously absent, indicating a systemic gap in enforcing permissions at the router layer.

Auth Bypass: Multiple management pages were rendered without checking admin or specific permissions. Fixes add session permission checks before rendering, but some are UI-only and backend enforcement is unclear, leaving potential for direct API calls to bypass.

Hardcoded Encryption Key / Missing Encryption: Encryption and auth secrets were hardcoded or defaulted, allowing attackers to decrypt stored integration secrets or forge session tokens. Fixes enforce environment-provided keys and generate random secrets, but legacy deployments may still be vulnerable.