Description
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | roundup | 1.4.4-4+lenny1 | DSA-1754-1 |
| Debian 4.0 | roundup | 1.2.1-10+etch1 | DSA-1754-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | roundup | >= 1.2, < 1.2.1 | 1.2.1 | GHSA-9rj9-5wcv-xgf2 |
| PyPI | roundup | >= 1.4, < 1.4.7 | 1.4.7 | GHSA-9rj9-5wcv-xgf2 |
| PyPI | roundup | >= 1.2, < 1.2.1 · >= 1.4, < 1.4.7 | 1.2.1, 1.4.7 | PYSEC-2026-744 |
Advisories 1
- DSA-1754-1 roundup - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34192 third-party-advisory
- 56368 vdb-entry
- FEDORA-2009-2583 vendor-advisory
- FEDORA-2009-2591 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768
- 34059 vdb-entry
- http://issues.roundup-tracker.org/issue2550521
- https://bugzilla.redhat.com/show_bug.cgi?id=489355
- DSA-1754 vendor-advisory