InactiveBleed
| CVE | Icon | Vulnerability name | Date | Responsible disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | InactiveBleed | 2026-09-26 | esbrito81 |  |
Responsible disclosure through a private GitHub security advisory; confirmed against current source and remediated by xet7. | Disabled accounts could authenticate through REST and retain existing sessions. The People status toggle failed to persist, and admin-created inactive accounts did not receive their requested status. Shared authentication guards, token revocation and atomic account creation now enforce account status. No CVE assigned. CWE-287 and CWE-613. Fix prepared for the Upcoming release. |
Fix
REST login, API tokens, attachment access, imports and exports share a disabled-account guard. Header login and REST token creation check status atomically when storing a token. LDAP leaves token issuance to the validated login pipeline. Disabling an account clears its login tokens; Meteor disconnects sessions observing those tokens. A server observer also revokes tokens on existing disabled accounts and direct database updates.
The People Active control calls the administrator-only server method. Admin-created accounts receive their status, administrator flag and profile in a trusted server creation context before insertion. Client-supplied creation options cannot grant these permissions. Reactivating an account does not restore revoked tokens. Anonymous access to public boards remains public. Requests already authorized before deactivation are not rolled back.
Attributable disabled-account authentication attempts appear as InactiveBleed summaries in Admin Panel / Problems. Routine administration is not logged as an attack.
Source fix and regression coverage
Verification
Positive and negative Node tests cover the shared decision, logging failure, token issuance and revocation, with a source audit of server, models, imports and packages. Browser tests cover inactive creation, REST and DDP login, reactivation, live-session revocation, direct database deactivation, the People control and rejected old credentials. The Meteor build, focused Node suites and three Chromium cases pass. Live LDAP and the FerretDB matrix were not exercised.