{"answers":{"affected":"2 open source packages ship an affected version, including gramps-webapi.","exploited":"There is no known exploitation of GHSA-9gjv-jvm7-vv2v in the wild and no public exploit code.","fix":"Upgrade gramps-webapi to 3.11.0 or later.","what":"GHSA-9gjv-jvm7-vv2v is a vulnerability in gramps-webapi, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-9gjv-jvm7-vv2v and fix it if it is affected.\n\nWhat it is: GHSA-9gjv-jvm7-vv2v is a vulnerability in gramps-webapi, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-9gjv-jvm7-vv2v in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- gramps-webapi (PyPI): affected all versions; fixed in 3.11.0\n- gramps-webapi (PyPI): affected all versions; fixed in 3.11.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-9gjv-jvm7-vv2v/ (Markdown: https://insights.sbomify.com/GHSA-9gjv-jvm7-vv2v/index.md)","id":"GHSA-9gjv-jvm7-vv2v","markdown":"https://insights.sbomify.com/GHSA-9gjv-jvm7-vv2v/index.md","name":"GHSA-9gjv-jvm7-vv2v","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Genealogy web API","requires_auth":"low_privilege","summary":"Guest users can access private sub-object data in public genealogy records via list endpoints if sub-objects were marked private in the desktop application.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nUsers with the **Guest** role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as `GET /api/people/`, `GET /api/places/`, `GET /api/events/`, and all other object list endpoints.\n\n**This does not expose objects (people, places, events, …) that are themselves marked private.** Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected.\n\n## Affected Versions\n\nAll versions of Gramps Web API prior to the fix.\n\n## Root Cause\n\nThe vulnerability originates from the behaviour of `PrivateProxyDb.iter_*()` in **Gramps core**. The `ProxyDbBase.__iter_object()` helper, which backs all `iter_*()` methods in `PrivateProxyDb`, correctly filters out top-level private objects but returns the remaining objects **unsanitized** — i.e. without stripping private sub-object references. In contrast, `PrivateProxyDb.get_*_from_handle()` does call the appropriate `sanitize_*()` function.\n\nGramps Web API's `ModifiedPrivateProxyDb` (which wraps the raw database for non-admin users) inherited this behaviour without override.\n\nThe same issue affects Gramps desktop features that consume `iter_*()` output: reports and exports generated via Gramps desktop using `PrivateProxyDb` may also include private sub-object data that should have been stripped.\n\n## Conditions Required\n\n**This issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop.** The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes,\ncitations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web.\n\n## Impact\n\nWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:\n\n- **Full content** of private embedded sub-objects on people, such as alternate  names (first name, surname, etc.) and addresses (street, city, etc.).\n- **Handles referencing** private notes, citations, and media attached to places,  events, sources, and other objects. These reveal the *existence* of private\n  linked objects but not their content; fetching those objects by handle is  correctly blocked by the proxy.\n\n## Fix\n\n`ModifiedPrivateProxyDb` now overrides all `iter_*()` object methods to check `obj.get_privacy()` directly on the already-loaded object (eliminating the redundant per-object refetch) and to call the appropriate `sanitize_*()` function before yielding each object. This is consistent with the behaviour of `get_*_from_handle()` in `PrivateProxyDb`.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users","id":"GHSA-9gjv-jvm7-vv2v","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["3.11.0"],"introduced":["0"],"last_affected":[],"package":"gramps-webapi","purl":null,"source":"GHSA-9gjv-jvm7-vv2v"},{"ecosystem":"PyPI","fixed":["3.11.0"],"introduced":["0"],"last_affected":[],"package":"gramps-webapi","purl":"pkg:pypi/gramps-webapi","source":"GHSA-9gjv-jvm7-vv2v"}],"products":null,"published":"2026-04-09","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Guest users can access private sub-object data in public genealogy records via list endpoints if sub-objects were marked private in the desktop application.","url":"https://insights.sbomify.com/GHSA-9gjv-jvm7-vv2v/"}