fix(security): rattrapage sécu conflictuel — 9 correctifs GHSA/scoping (résolution manuelle) - #104

Merged

userLinpy merged 10 commits into

fix/security-conflicts

Jul 21, 2026

Commits on Jul 21, 2026

[WEB-7855] fix(security): prevent project invite email disclosure via unauthenticated GET (#9305)

authored and
userLinpy
committed
5a60abb
[WEB-7894] fix: eliminate TOCTOU race in InstanceAdminSignUp (GHSA-p548-28jp-wr4p) (#9332)

authored and
userLinpy
committed
79413bf
[WEB-8017] fix(security): sanitize order_by on external REST API list endpoints (#9348)

authored and
userLinpy
committed
7c25673
[WEB-8019] fix(security): scope CycleIssue reassignment lookup to workspace/project (#9349)

authored and
userLinpy
committed
79b760c
[WEB-7887] fix(security): prevent stored XSS via SVG attachment served inline (GHSA-ch8j-vr4r-qf6h) (#9312)

authored and
userLinpy
committed
268da3e
[WEB-8012] fix: prevent ORM group_by/sub_group_by injection in issue endpoints (#9347)

authored and
userLinpy
committed
73ae6c8
[WEB-8068] fix: scope workspace cycles/modules listing to project membership (#9373)

authored and
userLinpy
committed
f82da14
[WEB-8095] fix: scope page-version reads to the URL project (GHSA-g49r/ghcr) (#9380)

authored and
userLinpy
committed
becb374
[WEB-8074] fix: scope IssueListEndpoint to guest created_by (#9374)

authored and
userLinpy
committed
6941fba
docs(security): journalise le lot de rattrapage sécurité conflictuel (9 correctifs GHSA/scoping)

userLinpy
and
claude
committed
c601576