Contributor License Agreement Assistant Security Vulnerabilities

CVE-2022-29617

Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application.

CVE-2023-39438

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as wel...