CVE-2009-2737
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- toni_mueller:roundup
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9rj9-5wcv-xgf2 | PyPI | roundup | >=1.2 <1.2.1 | 1.2.1 |
| GHSA-9rj9-5wcv-xgf2 | PyPI | roundup | >=1.4 <1.4.7 | 1.4.7 |
| PYSEC-2026-744 | PyPI | roundup | >=1.2 <1.2.1 >=1.4 <1.4.7 | 1.2.1, 1.4.7 |