Strike status filter accepted arbitrary strings in cobc-events

`/api/strikes` previously accepted any comma-separated string in `?status=` and forwarded it to the service layer without validation against the StrikeStatus enum.

Affected (1)

gelhaus-solutionscobc-events
- ≥ 0.0.0Fixed in 1.0.1

Mitigations

Workarounds

None required — defence-in-depth fix.

Solutions

Upgrade cobc-events to 1.0.1 or later.

Overview

/api/strikes previously accepted any comma-separated string in ?status= and forwarded it to the service layer without validation against the StrikeStatus enum.

Severity

CVSS v3

4.3 Medium

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Weaknesses (2)

References (2)

Patch in src/routes/strikes.js (Patch)
CWE-20: Improper Input Validation (Third-party advisory)

Credits (5)

Enno Gelhaus
Finder · egelhaus@ennogelhaus.de
Enno Gelhaus
Analyst · egelhaus@ennogelhaus.de
Enno Gelhaus
Remediation developer · egelhaus@ennogelhaus.de
Enno Gelhaus
Remediation reviewer · egelhaus@ennogelhaus.de
Claude (Anthropic) — automated audit assistant
Tool · https://claude.com

Context

Impacts

Improper input validation surfacing internal errors to clients

Timeline

04/25/2026 00:00
Internal security audit started
04/25/2026 06:00
Vulnerability identified during audit
04/25/2026 12:00
Patch developed and merged to main
04/25/2026 14:00
cobc-events 1.0.1 released
04/25/2026 15:00
Advisory published