Download Latest Version v0.20.3 source code.zip (2.3 MB)
Email in envelope

Get an email when there's a new version of Solarch

Home / 0.3.0
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-04-26 917 Bytes
0
TspoonBase v0.3.0 - Authorization Security Fixes source code.tar.gz 2026-04-26 1.1 MB
0
TspoonBase v0.3.0 - Authorization Security Fixes source code.zip 2026-04-26 1.2 MB
0
Totals: 3 Items   2.4 MB 0

Security fixes for authorization vulnerabilities:

Fixed in v0.3.0

[#1] Empty Rule Bypass (CWE-862, CVSS 9.1)

  • Fixed inconsistent logic between canAccessRecord and evaluateRule
  • Both functions now return false for empty/null rules
  • Prevents unauthorized data access via misconfigured collections

[#2] Admin Bypass All Rules (CWE-862, CVSS 9.8)

  • canAccessRecord now accepts skipAdminBypass parameter
  • Allows rule enforcement even for admin users when needed
  • Added protected field stripping to prevent privilege escalation

[#3] Role Field Escalation (CWE-269, CVSS 7.5)

  • Added stripProtectedFields() method
  • Blocks fields: _isAdmin, isAdmin, role, verified, mfaSecret, etc.
  • Prevents users from escalating their own privileges

Previous Releases

  • v0.2.9: Refresh token, OAuth2 state, password reset token fixes
  • v0.2.8: Rate limiting, bcrypt, JWT secret, file validation fixes
Source: README.md, updated 2026-04-26