Summary
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Users with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as GET /api/people/, GET /api/places/, GET /api/events/, and all other object list endpoints.
This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected.
Affected Versions
All versions of Gramps Web API prior to the fix.
Root Cause
The vulnerability originates from the behaviour of PrivateProxyDb.iter_*() in Gramps core. The ProxyDbBase.__iter_object() helper, which backs all iter_*() methods in PrivateProxyDb, correctly filters out top-level private objects but returns the remaining objects unsanitized, i.e. without stripping private sub-object references. In contrast, PrivateProxyDb.get_*_from_handle() does call the appropriate sanitize_*() function.
Gramps Web API's ModifiedPrivateProxyDb (which wraps the raw database for non-admin users) inherited this behaviour without override.
The same issue affects Gramps desktop features that consume iter_*() output: reports and exports generated via Gramps desktop using PrivateProxyDb may also include private sub-object data that should have been stripped.
Conditions Required
This issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes,
citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web.
Impact
When the conditions above are met, a user with the Guest role querying any list endpoint receives:
- Full content of private embedded sub-objects on people, such as alternate names (first name, surname, etc.) and addresses (street, city, etc.).
- Handles referencing private notes, citations, and media attached to places, events, sources, and other objects. These reveal the existence of private
linked objects but not their content; fetching those objects by handle is correctly blocked by the proxy.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
ModifiedPrivateProxyDb now overrides all iter_*() object methods to check obj.get_privacy() directly on the already-loaded object (eliminating the redundant per-object refetch) and to call the appropriate sanitize_*() function before yielding each object. This is consistent with the behaviour of get_*_from_handle() in PrivateProxyDb.
Frequently Asked Questions
- What is GHSA-9GJV-JVM7-VV2V? GHSA-9GJV-JVM7-VV2V is a medium-severity security vulnerability in gramps-webapi (pip), affecting versions < 3.11.0. It is fixed in 3.11.0.
- Which versions of gramps-webapi are affected by GHSA-9GJV-JVM7-VV2V? gramps-webapi (pip) versions < 3.11.0 is affected.
- Is there a fix for GHSA-9GJV-JVM7-VV2V? Yes. GHSA-9GJV-JVM7-VV2V is fixed in 3.11.0. Upgrade to this version or later.
- Is GHSA-9GJV-JVM7-VV2V exploitable, and should I be worried? Whether GHSA-9GJV-JVM7-VV2V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-9GJV-JVM7-VV2V is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-9GJV-JVM7-VV2V? Upgrade
gramps-webapito 3.11.0 or later.