Refer to the OpenWISP Security Policy.
Repository navigation
Security: openwisp/openwisp-controller
Security
.github/SECURITY.md
-
Django admin allows cross-organization configuration access with a known UUIDGHSA-2x7f-qxwh-m483 published
Oct 23, 2026 by nemesifierLow -
Stored XSS in template names can execute in administrator sessionsGHSA-4f2x-pxjx-h8m3 published
Oct 15, 2026 by nemesifierHigh -
Device-location updates can access and transfer locations across organizationsGHSA-39c4-xj33-j8j3 published
Oct 15, 2026 by nemesifierLow -
REST API allows cross-organization configuration download with a known UUIDGHSA-5c5w-h9xc-3mq5 published
Oct 23, 2026 by nemesifierModerate -
Shell injection in OpenWrt.change_password() via unsanitized password fieldsGHSA-rcf7-q946-fvpg published
Oct 23, 2026 by nemesifierLow -
OpenWISP Controller CA CRL REST API does not scope requests to managed organizationsGHSA-9gh4-xw24-9xh5 published
Oct 23, 2026 by nemesifierLow
Learn more about advisories related to openwisp/openwisp-controller in the GitHub Advisory Database