TeamPass is maintained as a single line: only the latest published release receives security fixes. There are no maintenance branches and no backports — a fix ships in the next release of the current line, and nowhere else.

Upgrading is the only supported remediation for an unsupported version. No patch, hotfix or backported release will be produced for a version that is no longer maintained, whatever the severity of the issue.

If you run an unsupported version, assume you are affected by every advisory listed below whose Fixed in column is later than the version you run — and by any issue that was fixed before this list was started.

For any vulnerability or potential security issue, please provide a complete description by filling in a new advisory form from https://github.com/nilsteampassnet/TeamPass/security/advisories/new.

This is the only supported reporting channel. Reports sent by email are not tracked and may be filtered as spam before anyone sees them. Please do not open a public issue, a discussion or a pull request for a security bug — use the advisory form so the report stays private until a fix is available.

A useful report contains: the exact TeamPass version, the relevant configuration (authentication mode, personal folders, API enabled…), a reproducible proof of concept, and the impact you consider it has.

Reports are welcome even when they target a version that is no longer maintained. They are triaged exactly like any other report, and the outcome depends on a single question: is the issue still present in the current release?

Publishing an advisory for an end-of-life version is deliberate, not a formality: it is the only mechanism that tells operators still running that version that they are exposed. It does not put the version back into support.

Duplicates are declined and linked to the advisory that already covers the issue; when a duplicate brings new analysis or a new attack path, the existing advisory is updated and its author is added to the credits rather than a second advisory being published for the same flaw.

In scope — anything in this repository that a remote attacker, or an authenticated user acting beyond their granted rights, can abuse against a correctly deployed instance running the current release: authentication and session handling, authorization and folder rights, the REST API, encryption and key management, injection (SQL, XSS, path traversal, command), and the installer and upgrade scripts.

Out of scope

• Self-XSS requiring the victim to paste a payload into their own browser.
• Findings produced by an automated scanner with no working proof of concept.
• Issues in third-party dependencies with no demonstrated exploit path in TeamPass — report those upstream.
• Anything that presupposes an already-compromised administrator account, shell access to the server, or direct database access.
• Denial of service through resource exhaustion on your own instance.
• Deliberately insecure deployments: TeamPass served over plain HTTP, the install/ directory left in place after setup, debug output enabled, world-readable configuration files.
• Missing hardening headers or cookie flags that the deployment (web server / reverse proxy) is responsible for.
• Social engineering, phishing, physical access.

1. Acknowledgement — within 5 business days.
2. Assessment — the report is reproduced against the current release, and the version range actually affected is established from the code, not assumed from the version you tested on.
3. Fix — target of 90 days for a confirmed issue in the current release; critical authentication or authorization bypasses are handled faster.
4. Disclosure — the advisory is published when the fixing release is out. When the issue turns out to be already fixed, it is published as soon as the analysis is confirmed.
5. Credit — reporters are credited in the advisory unless they ask not to be. TeamPass runs no bug bounty and offers no monetary reward.
6. CVE — requested through GitHub for every published advisory.

Please keep the report private until the advisory is published.

Vulnerabilities that have been fixed and publicly disclosed. The GitHub Security Advisory (GHSA) is the authoritative record for each entry. pending means a CVE ID has been requested but not yet assigned; the advisory is updated automatically once it is.

Each entry is fixed in the version listed and in every later release. Always upgrade to the latest release rather than to the exact version named here.