All issues

Search results

security(spp_change_request_v2): compliance.yaml omits split_household.member and 90 of 93 record rules

Status: Open.

#405 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Aug 10, 2026

security(spp_change_request_v2): the shipped 'CR Requestor' role grants Manager + approval-approver — least-privileged persona is fully privileged [Severity: High]

Status: Open.

#404 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Aug 10, 2026

security(spp_change_request_v2): post-submit content freeze covers only field_mapping types — custom-strategy details stay writable [follow-up to #264]

Status: Open.

#403 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Aug 10, 2026

security(spp_dci): rename the 'DCI Administrator' group — the name no longer describes what it grants [follow-up to #327]

Status: Open.

#398 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Aug 10, 2026

spp_attachment_av_scan: 7 remaining except Exception sites can swallow database errors (follow-up to #384)

Status: Open.

#385 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Aug 3, 2026

spp_base_common: menu-icon env.ref hook can take down a job worker on a poisoned cursor

bugSomething isn't workingSomething isn't working

Status: Open.

#383 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 31, 2026

security(spp_grm_cel): rule-engine entry points are unguarded RPC-callable methods [Severity: Medium]

Status: Open.

#381 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 28, 2026

security(spp_grm): portal users have read/write/create on EVERY grievance ticket (no record rule targets portal) [Severity: High]

Status: Open.

#380 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 28, 2026

security(spp_grm_cel): escalation/routing rules evaluate as superuser — GRM officer can seize every ticket [Severity: High]

Status: Open.

#379 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 28, 2026

spp_alerts: Alerts Manager can edit/delete/disable other users' (incl. admins') alert rules (no owner-scoping) — integrity/availability [Low-Medium]

Status: Open.

#374 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

security(spp_api_v2_gis): OGC features numberMatched / report record_count / export leak unsuppressed beneficiary counts [Severity: Medium]

Status: Open.

#373 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026

security(spp_approval): approval_state writable directly, bypassing the approval workflow (shared mixin) [Severity: Medium]

Status: Open.

#369 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 27, 2026