Security advisories

Security advisories

To report a vulnerability, see our security disclosure policy.

Teams could be given packages of another organization and receive its security notifications 2026-10-21
PPSA-202610-14 Cloud Self-Hosted <= 2.0.37
Suborganization members could download cached archives of the main organization through another repository host name 2026-10-21
PPSA-202610-13 Cloud Self-Hosted <= 2.0.37
Composer plugin allowlist did not apply to packages of the legacy plugin type composer-installer 2026-10-21
PPSA-202610-12 Cloud Self-Hosted >= 2.0.34, <= 2.0.37
Regenerated Composer authentication tokens kept working with the previous username after a username change 2026-10-21
PPSA-202610-11 Cloud Self-Hosted <= 2.0.37
Suborganization admins could redirect notification channels the main organization uses 2026-10-21
PPSA-202610-10 Cloud Self-Hosted <= 2.0.37
Update Review comments could show details of another organization's packages 2026-10-21
PPSA-202610-9 Cloud Self-Hosted <= 2.0.37
Crafted packages could expose the code of other organizations' packages and other directories on the servers 2026-10-21
PPSA-202610-8 Cloud Self-Hosted <= 2.0.37
Authentication tokens and members of a deleted team, and members removed from a team on GitHub, kept access to its packages 2026-10-21
PPSA-202610-7 Cloud Self-Hosted <= 2.0.37
Open redirect in the links to join a team and to log in or connect an account with an OAuth provider 2026-10-21
PPSA-202610-6 Cloud Self-Hosted <= 2.0.37
Users of other organizations and vendor customers could check whether a package name existed in an organization 2026-10-21
PPSA-202610-5 Cloud Self-Hosted <= 2.0.37
Removed synchronized members kept access to suborganizations through their teams 2026-10-21
PPSA-202610-4 Cloud Self-Hosted <= 2.0.37
Suborganization admins could add teams and credentials of the main organization to their suborganization 2026-10-21
PPSA-202610-3 Cloud Self-Hosted <= 2.0.37
Suborganization admins could receive security notifications for the main organization's private packages 2026-10-02
PPSA-202610-2 Cloud Self-Hosted <= 2.0.36
Crafted package metadata could overwrite or delete stored archives of other organizations 2026-10-01
PPSA-202610-1 Cloud Self-Hosted <= 2.0.36
Suborganization admins could add parent organization packages they had no access to 2026-09-30
PPSA-202609-1 Cloud Self-Hosted <= 2.0.36
Private network filter could be bypassed with IPv6 addresses 2026-06-04
PPSA-202606-1 Cloud
Previous Composer authentication token stayed valid after regenerating it 2026-05-26
PPSA-202605-2 Cloud Self-Hosted < 2.0.33
API request signatures did not cover query parameters 2026-05-08
PPSA-202605-1 Cloud Self-Hosted < 2.0.33
Command injection through Composer via Perforce package information 2026-04-14
PPSA-202604-1 Cloud Self-Hosted < 2.0.32 Upstream CVE-2026-40261
Team invitations could be used to join a different team 2024-10-03
PPSA-202410-1 Cloud Self-Hosted < 2.0.5
Reflected cross-site scripting in the custom package form 2024-06-12
PPSA-202406-4 Cloud Self-Hosted < 2.0.3
Reflected cross-site scripting in the integration form 2024-06-12
PPSA-202406-3 Cloud Self-Hosted < 2.0.3
Open redirect in the link to join a team 2024-06-12
PPSA-202406-2 Cloud Self-Hosted < 2.0.3
Mirrored repository and notification URLs could redirect to insecure URLs 2024-06-12
PPSA-202406-1 Cloud Self-Hosted < 2.0.3
Packages of another organization could be imported 2024-05-29
PPSA-202405-1 Cloud Self-Hosted < 2.0.3
Billing team members could add packages from mirrored repositories 2024-04-08
PPSA-202404-2 Cloud Self-Hosted < 2.0.3
Organization log accessible to all organization members 2024-04-05
PPSA-202404-1 Cloud Self-Hosted < 2.0.3
Missing CSRF protection on several actions 2024-03-21
PPSA-202403-2 Cloud Self-Hosted < 2.0.2
Owners team memberships could be managed through the API 2024-03-12
PPSA-202403-1 Cloud Self-Hosted < 2.0.2
Missing CSRF protection when disconnecting OAuth accounts 2024-02-27
PPSA-202402-1 Cloud Self-Hosted < 2.0.2
Password reset links did not expire 2024-01-03
PPSA-202401-1 Cloud Self-Hosted < 2.0.1
Multi-factor authentication not required after OAuth login 2023-09-01
PPSA-202309-1 Cloud Self-Hosted = 1.12.0 | = 1.12.0-pl1 | = 1.12.0-pl2
Argument injection through Composer when processing packages 2022-04-13
PPSA-202204-1 Cloud Self-Hosted < 1.11.3 Upstream CVE-2022-24828
Command injection through Composer when processing packages 2021-04-27
PPSA-202104-1 Cloud Self-Hosted < 1.10.6 Upstream CVE-2021-29472
Sensitive data exposed through a Replicated API 2020-03-23
PPSA-202003-1 Self-Hosted < 1.9.9 Upstream CVE-2020-10590

Articles

Features

Start Free Trial

Login to create an organization and start your free trial!