4 posts
The alt text health report in @jhb.software/payload-alt-text-plugin scanned every tenant with overrideAccess: true and flattened Where-based read rules to a yes, handing any logged-in user counts and up to 100 document IDs from rows they cannot read. GHSA-3pmw-vxv3-8vgq, CVSS 4.3, fixed in 0.13.0.
Kimai locked its project report behind a permission check and left the export route beside it open. Any logged-in user could download customer names, project names, and budget metadata across every customer. Advisory GHSA-pvc4-crg3-gj44, CVE-2026-80194, patched in 2.64.0.
A ROLE_TEAMLEAD user in Kimai 2.56.0 could set systemAccount:true on their own profile through the user API and disappear from every billing report, every user dropdown, and every teammate's view. One missing permission check. Patched in 2.57.0, credit in the release notes.
Five CVEs disclosed in Tryton ERP through responsible disclosure -- stored XSS that escalates to unauthenticated via email, access control bypasses on data exports, and stack traces handed to any logged-in user. All patched, all basic, all in production for years.