Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

matomo-org/plugin-LoginLdap

              6.x-dev @ 7b8d1d8
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

LoginLdap.php: most-fixed (7 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address login canonicalization and reserved-user checks during synchronization, indicating a high-risk path where an LDAP login can map to a different Matomo account or the 'anonymous' user, enabling account takeover or privilege escalation.

Auth Bypass: Password confirmation for LDAP configuration and settings changes was repeatedly bypassed, allowing unauthorized modifications to authentication settings.

Auth Bypass: Password change, reset, and token creation operations for LDAP users were not consistently blocked, allowing local password changes or token minting that bypass LDAP as the source of truth.