Search results

security(spp_grm_cel): rule-engine entry points are unguarded RPC-callable methods [Severity: Medium]

Status: Open.

#381 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 28, 2026

security(spp_grm): portal users have read/write/create on EVERY grievance ticket (no record rule targets portal) [Severity: High]

Status: Open.

#380 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 28, 2026

security(spp_grm_cel): escalation/routing rules evaluate as superuser — GRM officer can seize every ticket [Severity: High]

Status: Open.

#379 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 28, 2026

spp_alerts: Alerts Manager can edit/delete/disable other users' (incl. admins') alert rules (no owner-scoping) — integrity/availability [Low-Medium]

Status: Open.

#374 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

security(spp_api_v2_gis): OGC features numberMatched / report record_count / export leak unsuppressed beneficiary counts [Severity: Medium]

Status: Open.

#373 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

security(spp_approval): approval_state writable directly, bypassing the approval workflow (shared mixin) [Severity: Medium]

Status: Open.

#369 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

security(spp_api_v2_gis): proximity 'beyond' count enables differencing of a small 'within' count [Severity: Low]

Status: Open.

#368 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

security(spp_api_v2_gis): batch spatial query counts differenceable across geometries + summary [Severity: Low]

Status: Open.

#367 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

spp_registry: future birthdate accepted via ORM/import/API, yields negative computed age

Status: Open.

#362 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

ci: pre-commit --all-files newly red repo-wide from linter version drift (unpinned pylint/astroid under pylint-odoo)

Status: Open.

#361 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_api_v2_simulation): analytics API computes unpublished statistics (no is_published_api allowlist) [Severity: Medium]

Status: Open.

#360 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_programs): Program Validator still carries Tier-2 registry viewer (Registry Search menu) [Severity: Low]

Status: Open.

#355 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026