Add user-facing security notes for the three advisories published on
2026-07-09: the ADMIN-to-OWNER privilege escalation via createUser
(GHSA-cppp-g98f-gfpp), the unauthenticated cross-tenant and
hidden-item disclosure via Query.node in the Trust Center API
(GHSA-w23w-f7v2-625w), and the broken access control in the public
e-signature NDA API (GHSA-22xj-f767-ppw6). Each note summarizes the
flaw and the shipped remediation and credits the reporter.
Also backfill the advisory and CVE references on the existing open
redirect note, which already had a fix but no published identifiers.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Add SECURITY_NOTES.md entries for GHSA-c74x-79w6-63jh (cross-tenant
IDOR via unvalidated Finding->Risk and ProcessingActivity->DPO
references) and GHSA-prh2-g8pv-m7p9 (GraphQL alias-flooding DoS),
ahead of public disclosure.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Relative redirect URLs are now normalized before validation. Paths
containing backslashes (including percent-encoded %5c) are rejected,
closing a bypass where /../\evil.com passed checks but http.Redirect
normalized to /\evil.com.
Reported by Fushuling and RacerZ.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Previous entry leaned on filler ("close the door behind it", "what
people expect") and gave only a vague behavioural summary. Replace
it with the actual mechanism: which table is touched, the transaction
boundary, the asymmetry between change (preserves caller) and reset
(revokes all), and why the session middleware needs no change.
Also drop the em dash in the metadata line.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
