Re-auth on DB export/import + SSRF guard on web fetch
fix(security): re-auth on DB export/import + SSRF guard on web fetch
Re-auth on DB export/import + SSRF guard on web fetch0c7c9d-fix-re-auth-on-db-export-import-ssrf-cve-2026-55500fixauth export import ssrf guard web
Committed by decolua
commit message
fix(security): re-auth on DB export/import + SSRF guard on web fetch
- /api/settings/database now requires current password (header for GET,
body for POST) in addition to session; CLI-token requests exempt
- add verifyDashboardPassword helper reusing login bcrypt check
- profile UI prompts password via modal before export/import
- /v1/web/fetch rejects internal/private/metadata targets via assertPublicUrl
Refs GHSA-qvfm-67h2-2qfx, GHSA-qj3v-64wj-q825
Co-authored-by: Cursor <[email protected]>Editor assessment
This commit patches CVE-2026-55500. The subject names two distinct defenses, requiring re-authentication on database export/import and adding an SSRF guard to web fetch, which is informative if slightly compound. The body supplies concrete implementation notes: the password header for GET versus body for POST, a helper reusing the bcrypt login check, the UI modal, and the internal-target rejection. The `security` scope and `fix` type are accurate. The footer is malformed, though: `Refs GHSA-qvfm-67h2-2qfx, ...` is missing the colon that makes the token machine-readable, and two advisories are packed into one value. Useful content, but the footer grammar violation caps how far it can be recommended.