| Version | Supported |
|---|---|
| 3.x | ✅ |
| 1.x | ❌ |
If you discover any security related issues, please email to info@lubus.in instead of using the issue tracker.
Repository navigation
Security: lubusIN/gymie
Security
SECURITY.md
-
Gymie Security Advisory Report — Inactive Users Retain API Access via Bearer TokensGHSA-8hp8-g39c-pr4q published
Sep 30, 2026 by ajitbohraHigh -
Invoice Financial Data Manipulation via subscription_fee — Any authenticated user with Update:Invoice permission can wipe outstanding balancesGHSA-wq4v-4657-76rf published
Sep 9, 2026 by ajitbohraHigh -
User Deactivation Is Cosmetic — Inactive Users Retain Full API and Panel AccessGHSA-h4xw-qhw3-38j5 published
Sep 9, 2026 by ajitbohraHigh -
Privilege Escalation via Role AssignmentGHSA-5m75-cm84-57m7 published
Sep 9, 2026 by ajitbohraHigh -
Missing Authorization on Analytics Endpoints allows any authenticated user to access financial and operational dataGHSA-c2r5-vvhq-r775 published
Sep 2, 2026 by ajitbohraHigh -
Missing Authorization on GET/PUT /api/v1/settings allows any authenticated user to read and modify system-wide configurationGHSA-88p9-xjpj-4jqp published
Sep 2, 2026 by ajitbohraHigh
Learn more about advisories related to lubusIN/gymie in the GitHub Advisory Database