Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pkp/pkp-lib

              main @ fed8315
            

233

Fixes

CVEs

CRITICAL

Peak severity

32.3%

Coverage

Highlights

Auth Bypass: 105 prior fixes. Scrutinize any change in this area.

classes/session/SessionManager.php: most-fixed (6 issues). Treat as high-risk during review.

169 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The most frequent and severe class; many fixes add missing role-based policies (UserRolesRequiredPolicy, SubmissionAccessPolicy, WorkflowStageAccessPolicy) or scope checks (submission ID, context ID) to API and grid handlers. A systemic risk of missing or misapplied authorization on new endpoints and grid operations.

Authorization Bypass: Policies often fail to enforce submission/context scoping (IDOR-like) or active role membership, allowing cross-submission or cross-context access. Fixes add parent ID checks, active membership checks, and context validation.

CSRF: Missing CSRF tokens on state-changing operations (grid saves, deletes, uploads, form submissions) across many handlers and templates. Fixes add FormValidatorCSRF or token checks to URLs/forms/JS POSTs.