Security: tolgee/tolgee-platform
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Broken object-level authorization across EE/project resources (BOLA)GHSA-535f-x3hw-p4p8 published
Jun 2, 2026 by dkrizanHigh -
Unauthenticated Slack bot-event signature bypass allows deleting a workspace integrationGHSA-4mw7-vff5-96jj published
Jun 2, 2026 by dkrizanHigh -
XXE Injection in Translation ImportGHSA-rcvv-64pq-vxfx published
Mar 11, 2026 by JanCizmarCritical -
Configuration all configuration properties leaked in public configuration DTOGHSA-3wr3-889v-pgcj published
Nov 12, 2024 by JanCizmarCritical -
API keys created by server admin users bypass the permission checkGHSA-pm57-hcm8-38gw published
Apr 18, 2024 by JanCizmarModerate -
Permission scopes not checked correctly when querying key and translation dataGHSA-r95p-fqqv-fppc published
Apr 18, 2024 by JanCizmarLow -
HTML Injection with Tolgee email - OrgGHSA-gx3w-rwh5-w5cg published
Sep 7, 2023 by JanCizmarModerate -
Lack of Permission Check for API Key for some endpointsGHSA-4f9j-4vh4-p85v published
Jul 27, 2023 by JanCizmarHigh