Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #47776 Users can spam the history log of a project
    Infos
    #47776
    Thomas Gerbet (tgerbet)
    2026-08-05 11:41
    2026-08-05 11:27
    49519
    Details
    Users can spam the history log of a project

    Users can use the endpoint allowing them to remove themselves from a project via the MyProjects to spam the project history logs of projects they are not member of by calling the endpoint multiple times.

    Issue spotted during an AI assisted audit (Opus-5).
    Internal reference: CLAUDE-SECURITY-20260729-132350 F19.

    Project admin
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Under review
    Empty
    Attachments
    Empty
    References
    Referenced by request #47776

    Other

    gerrit #38552
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2026-08-05 11:29
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    • Reported in version set to All