Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

plankanban/planka

              master @ de4d768
            

Fixes

CVEs

CRITICAL

Peak severity

42.1%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

server/api/controllers/access-tokens/create.js: most-fixed (5 issues). Treat as high-risk during review.

15 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical bypasses in token creation and OIDC exchange; fixes added TOTP, SSO enforcement, and secure code flow.

Path Traversal: Attacker-controlled filenames in file read/delete operations led to arbitrary file access; fixed via file manager abstraction and path validation.

Access Control: Attachments were publicly accessible without authorization; fixed by moving to private storage and adding board/project checks.