Security: cross-tenant access to import profiles and runs
On multi-user instances, any authenticated user could read, edit and delete every other user's import profiles and import runs, through both the web interface and the API. That exposed uploaded file names, run logs (which can include values from the imported file) and profile configurations, and let users change or delete each other's profiles. Transactions were not exposed, and single-user instances are not affected.
Version 0.24.0 adds ownership to imports:
- Import profiles now work like rules: they have an owner, private or public visibility, and can be shared with specific users. Only the owner can edit them or change their sharing.
- Import runs belong to the user who uploaded the file and are only visible to them, even when made with a shared profile.
This release includes a database migration. Existing runs are assigned to the owner of the transactions they imported. Existing profiles, and runs that can't be matched to a user (for example failed runs, or runs whose transactions were deleted), stay unowned and remain visible to everyone. Use Take ownership on a profile to make it private to you.
Thanks to @NotAFlightRisk for reporting the issue and providing a proof of concept.
Advisory: GHSA-q668-h56g-mfp4
Implementation: #629
What's Changed
- Keep dropdown submenu open while moving the pointer into it by @eitchtee in #620
- Translations update from Weblate by @eitchtee in #619
- fix(transactions): apply the form amount when converting a paid transaction by @eitchtee in #621
- Translations update from Weblate by @eitchtee in #623
- build(deps): bump certifi to 2026.10.19 (GHSA-6q48-6c7w-9gw2, critical) by @obervinov in #624
- fix(rules): write set_mute action to mute instead of is_paid by @obervinov in #625
- build(deps): bump vite from 8.0.16 to 8.3.5 in /frontend by @dependabot[bot] in #626
- build(deps): bump django-allauth to 65.20.1 to unblock oauthlib 4.0.0 by @eitchtee in #627
- test(users): fix OIDC tests after allauth 65.20 bump by @eitchtee in #628
- fix(import): enforce object-level authorization on import profiles and runs by @eitchtee in #629
Full Changelog: 0.23.3...0.24.0