Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozilla/addons-server

              master @ 4e2ca49
            

Fixes

CVEs

CRITICAL

Peak severity

45.8%

Coverage

Highlights

Auth Bypass: 18 prior fixes. Scrutinize any change in this area.

src/olympia/api/permissions.py: most-fixed (4 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple permission classes were bypassed due to incorrect object relations or overly broad checks, allowing unauthorized access to add-ons and versions.

Auth Bypass: Admin actions for banning/unbanning users were gated only by a broad permission, allowing privilege escalation.

Auth Bypass: API view querysets and filters allowed access to deleted/unlisted add-ons and sensitive version data without proper permission checks.