38629041304
98%

Ran 14 Oct 2026 08:15PM UTC

Jobs 1

Files 143

Run time 1min

Badge

Embed ▾

Committed 14 Oct 2026 08:04PM UTC coverage: 98.359% (+0.02%) from 98.341%

Build # 38629041304

Build Type

push

github

Committed by

web-flow

Commit Message

[fix] Fixed insecure multi-tenancy boundary in location REST API

Fixed a **security issue** that allowed organization managers to link
locations and floorplans belonging to other organizations to their
devices by submitting known object IDs.

The API now resolves related objects only from organizations managed
by the requesting user and validates the organization of all
device-location relationships. Device lists for a location are scoped
to managed organizations and no longer expose device keys.

Nested location and floorplan writes are validated before being saved
and run in a database transaction, preventing rejected requests from
leaving related database objects or files behind.

Advisory: **GHSA-39c4-xj33-j8j3**.

[backport 1.3]

---------

Co-authored-by: Federico Capoano <f.capoano@openwisp.io>

Coverage Stats

7853 of 7984 relevant lines covered (98.36%)

7.87 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	python- - 38629041304.1	14 Oct 2026 08:15PM UTC	143	98.36	GitHub Action Run

openwisp / openwisp-controller / 38629041304
98%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 38629041304

openwisp / openwisp-controller / 38629041304 98%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 38629041304

openwisp / openwisp-controller / 38629041304
98%

README BADGES
x