Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sehmaschine/django-grappelli

              master @ 98c98e7
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

CSRF: 4 prior fixes. Scrutinize any change in this area.

grappelli/dashboard/modules.py: most-fixed (1 issue). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Centralized permission check added after inconsistent enforcement across three lookup views; missing checks could expose staff-only data to unauthorized users.

Auth Bypass: View permission check added to admin URL generation; without it, view-only users may see or access URLs they shouldn't.

CSRF: Form POST lacked CSRF token, enabling cross-site request forgery on admin change actions.