Please report (suspected) security vulnerabilities to security@tolgee.io You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
Repository navigation
Security: tolgee/tolgee-platform
Security
SECURITY.md
-
MCP tools skip permission checks their REST-twin endpoints enforce in-handler-body, allowing unauthorized translation writes and other project-scope bypassesGHSA-j998-54vh-rwpg published
Nov 6, 2026 by bdshadowHigh -
IPv6 transition address (NAT64/6to4/Teredo) bypass of UrlSecurity SSRF guard in webhook, LLM provider, and SSO endpointsGHSA-6hgf-xx56-2j3v published
Nov 11, 2026 by dkrizanModerate -
Unauthenticated cross-tenant disclosure of real-time translation edits via wildcard WebSocket subscriptionGHSA-pr7g-mjm2-f93w published
Nov 7, 2026 by dkrizanHigh -
SSRF via Unvalidated S3 Endpoint in Content Storage Test Bypasses Existing UrlSecurity GuardGHSA-hqr8-67r5-xj69 published
Nov 6, 2026 by dkrizanHigh -
SSRF via DNS rebinding bypasses UrlSecurity for LLM provider and webhook URLs (TOCTOU)GHSA-q6mm-jcr5-9qw2 published
Nov 7, 2026 by dkrizanHigh -
Broken object-level authorization across EE/project resources (BOLA)GHSA-535f-x3hw-p4p8 published
Jun 2, 2026 by dkrizanHigh -
Unauthenticated Slack bot-event signature bypass allows deleting a workspace integrationGHSA-4mw7-vff5-96jj published
Jun 2, 2026 by dkrizanHigh -
Auto-translate bypasses language-scoped translation permissions and overwrites unauthorized target languagesGHSA-49fw-h6cj-7r7x published
Nov 11, 2026 by dkrizanModerate -
XXE Injection in Translation ImportGHSA-rcvv-64pq-vxfx published
Mar 11, 2026 by JanCizmarCritical -
🛡️ Bug Report: 2FA Misconfiguration Allows Permanent Victim LockoutGHSA-p5q8-2wc4-g5hg published
Nov 11, 2026 by dkrizanCritical
Learn more about advisories related to tolgee/tolgee-platform in the GitHub Advisory Database