CVE-2008-1475: Roundup XML-RPC Server Property Permissions Bypass
Summary
CVE-2008-1475: The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods. Affects roundup versions < 1.4.5. Fixed in 1.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is an issue tracking system and bug tracker written in Python. It provides a web-based interface for managing and tracking issues, as well as an XML-RPC server for remote access. The XML-RPC server allows users to perform various operations on properties, such as listing, displaying, and setting values. However, in Roundup version 1.4.4, the server does not properly check property permissions, which can lead to unauthorized access and modification of restricted properties.
Vulnerability Detail
The vulnerability in Roundup 1.4.4 lies in the XML-RPC server's lack of property permission checks. Attackers can exploit this flaw to bypass restrictions and manipulate restricted properties using the 'list', 'display', and 'set' methods. By doing so, they can gain unauthorized access to sensitive information or modify properties that should be restricted. This vulnerability poses a risk to the confidentiality and integrity of data stored in Roundup.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.5
This is the first release that contains the fix.
pip install --upgrade "roundup==1.4.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to a fixed version of Roundup.
Conclusion
The vulnerability in the Roundup XML-RPC server allows attackers to bypass property permissions and manipulate restricted properties. To mitigate this risk, it is crucial to upgrade to a fixed version of Roundup (1.4.5 or later). For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for roundup →
FAQ
Roundup is an issue tracking system and bug tracker written in Python.
This vulnerability allows attackers to bypass property permissions and access or modify restricted properties in Roundup, potentially compromising the confidentiality and integrity of data.
To fix this vulnerability, you should upgrade your Roundup installation to version 1.4.5 or later.
No specific workarounds are available for this vulnerability. Upgrading to a fixed version is the recommended solution.
For more information about this vulnerability, you can refer to the Roundup advisory PYSEC-2008-10.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
