Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
projectsend/projectsend
main @ fb93181
43
Fixes
0
CVEs
CRITICAL
Peak severity
29.7%
Coverage
Highlights
Information Disclosure: 8 prior fixes. Scrutinize any change in this area.
app/Modules/Audit/Http/Controllers/DashboardController.php: most-fixed (2 issues). Treat as high-risk during review.
33 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Authorization Bypass / Information Disclosure: Recurring missing StaffLibraryScope checks allow scoped staff to access or modify resources outside their library, including files, clients, groups, and comments. Multiple fixes across different controllers address the same root cause, indicating systemic gaps.
Privilege Escalation: Client-scoped users could escalate to full library access by modifying roles, assigning themselves clients, or promoting clients without proper scope checks. These are direct privilege escalation paths that bypass the library boundary.
Authentication Bypass: Multiple auth bypasses via password reset for directory accounts, TOTP replay race conditions, placeholder password confirmation, and 2FA enforcement gaps. These undermine core authentication guarantees.