Security Review — 2026-07-08 — security-warning

[jdrumgoole]

Summary

Daily security review for 2026-07-08. 3 WARNING findings identified by a deeper owner_id data isolation audit.

WARNING findings (3)

• WARN-1: winebox/routers/export.py:250 — Wine lookup in export_transactions missing owner_id filter
• WARN-2: winebox/services/cellar_event_view.py:179 — Bulk Wine lookup in list_events_as_transactions missing owner_id filter
• WARN-3: winebox/services/cellar_event_view.py:219 — Single Wine lookup in get_event_as_transaction missing owner_id filter

All three are secondary lookups where the wine_ids are derived from owner-scoped data. MongoDB ObjectIds are globally unique, so exploitation requires data corruption. However, these violate the project's stated security policy that all user data queries must filter by owner_id.

New INFO findings (2)

• INFO-38: Pillow 12.2.0 — 3 new CVEs (CVE-2026-55379, CVE-2026-55380, CVE-2026-55798), none exploitable via WineBox
• INFO-39: Six update_one calls that don't re-assert owner_id in the filter (defence-in-depth)

Carried forward

• 37 INFO findings from previous review, unchanged
• No code changes since last review
• All dependency versions unchanged

Top 3 priorities

1. Fix WARN-1/2/3 — simple one-line fixes to add owner_id to three query filters
2. Batch dependency upgrade (cryptography, python-multipart, PyJWT, Pillow) — closes 12 CVEs
3. Plan coordinated FastAPI + Starlette upgrade (4 accumulated CVEs)

Full report: docs/security-reports/2026-07-08.md

---

Generated by Claude Code