CVE-2009-2737: Roundup Improper Access Control Vulnerability
Summary
CVE-2009-2737: Roundup Improper Access Control. Affects roundup across 2 version ranges.
>= 1.2, < 1.2.1
>= 1.4, < 1.4.7
Fixed in 1.2.1 or 1.4.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is an open-source issue-tracking system that helps manage and track issues, bugs, and tasks in software development. It provides a web-based interface and supports various features such as customizable issue types, user roles, and permissions. However, certain versions of Roundup are vulnerable to improper access control, allowing unauthorized modifications to items within a class.
Vulnerability Detail
The vulnerability arises from the EditCSVAction function in cgi/actions.py in Roundup versions 1.2 before 1.2.1 and 1.4 through 1.4.6. It fails to properly check permissions, which enables remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class. This can lead to unauthorized changes to queries, settings, and user roles, potentially compromising the integrity of the issue-tracking system.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.2, < 1.2.11.2.1pip install --upgrade "roundup==1.2.1" -
>= 1.4, < 1.4.71.4.7pip install --upgrade "roundup==1.4.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the EditCSVAction function by modifying the permissions for users with edit or create privileges. This can be done by reviewing and adjusting the user roles and permissions in the Roundup configuration to limit unauthorized access.
Conclusion
The CVE-2009-2737 vulnerability in Roundup poses a significant risk by allowing unauthorized modifications to items within a class. It is crucial for users to upgrade to the patched versions to ensure the integrity and security of their issue-tracking systems. Implementing temporary workarounds can help mitigate risks until an upgrade is performed.
See every vulnerability recorded for roundup →
FAQ
CVE-2009-2737 is a vulnerability in Roundup that allows unauthorized users to modify items within a class due to improper access control.
Roundup versions 1.2 before 1.2.1 and 1.4 through 1.4.6 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider implementing stricter access controls and reviewing user permissions to mitigate the risk.
More information about Roundup can be found on its official website and documentation, which provide insights into its features and usage.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
