Skip to content

plugin-approvals: authorization-adjacent disclosure on the approval request doors (detail withheld pending maintainer) #25487

New issue
New issue
Closed as not planned
Closed as not planned
plugin-approvals: authorization-adjacent disclosure on the approval request doors (detail withheld pending maintainer)#25487
Labels
area:workflowApprovals and automation — the work that runs without a person driving itbugSomething isn't workingdomain:serverDomain lane — seat card indexed by label:pm:seatpriority:p2Medium: important, M3security

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 23, 2026

QA-source: #25479 · approvals.record-page-decisions · observed beside the clauses
QA-source: #25478 · approvals.account-app-entry · observed beside the clauses

An authorization-adjacent behavior on the plugin-approvals HTTP doors was observed independently by two runners on main 77392e9 (stock showcase, non-participant member persona). It is an information-disclosure class finding. The runners rated it low severity: no field value is disclosed, and the identifiers involved are random.

Detail withheld pending maintainer. Under the RUNNER rule 2 carve-out, the reproduction is not published. It is held in the runner session and is available to the maintainer on request.

Activity

  1. objectstack-fleet
    added
    area:workflowApprovals and automation — the work that runs without a person driving it
    bugSomething isn't working
    domain:serverDomain lane — seat card indexed by label:pm:seat
    pm:awaiting-maintainerAwaiting a manual maintainer action — ruling already given; no dispatch, no machine exit
    priority:p2Medium: important, M3
    security
    on Oct 23, 2026

  2. objectstack-fleet commented on Oct 24, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 24, 2026
    ContributorAuthor

    Half-state closed · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-24T10:53Z

    pm:awaiting-maintainer came on at R613 without its Maintainer-action: line. The line is below. The grade is unchanged: p2 · security · domain:server · area:workflow. ⛔ Nothing about the mechanism goes on this card (#9387).

    Maintainer-action: get the withheld detail from the QA runner session behind #25478 / #25479, or have a private QA session re-measure it, and hand it to a domain:server dev session off GitHub — done when a claim comment on this card says the detail was received off GitHub

    Generated by Claude Code

  3. objectstack-fleet commented on Oct 27, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 27, 2026
    ContributorAuthor

    Ruling: maintainer 「25487 关卡」 (Leehom, 2026-10-27T04:08:25Z) · close · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-10-27T04:08Z

    The maintainer closed this card on its pm:awaiting-maintainer action. pm:awaiting-maintainer comes off, and the card closes as not_planned. The withheld detail stays off GitHub, as it has from filing. Nothing is dispatched from this card.

    Generated by Claude Code

  4. objectstack-fleet
    removed
    pm:awaiting-maintainerAwaiting a manual maintainer action — ruling already given; no dispatch, no machine exit
    on Oct 27, 2026
  5. objectstack-fleet
    closed this as not plannedon Oct 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:workflowApprovals and automation — the work that runs without a person driving itbugSomething isn't workingdomain:serverDomain lane — seat card indexed by label:pm:seatpriority:p2Medium: important, M3security

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions