Date: 2026-08-08 (Day 56). Context: incomplete-fix/cross-fork lane, Forgejo excluded. 1 MED confirmed (Homarr), 1 clean N-A (OpenBao), 1 cross-ref WALK-fast (Froxlor).
widget.app.ping (CVE-2026-25123, v1.52) rebound to a DB id, widget.rssFeed (CVE-2026-27797, v1.54) restricted to stored URLs - but the common fetch layer fetchWithTrustedCertificatesAsync has NO private-IP/DNS/allowlist guard. So the third unauth URL-controlling publicProcedure, widget.timetable.getTimetable/searchStations, still takes a raw client baseUrl -> new URL(baseUrl+path) -> unguarded fetch(), at v1.74.0 HEAD. Rule: when a project fixes an SSRF class per-endpoint instead of adding a shared fetch-layer guard, enumerate EVERY unauth procedure that takes a client URL - the maintainer who fixed 2 of 3 usually missed the 3rd. The "fixed N-1 of N, missed one" asymmetry is itself the strongest incomplete-coverage signal.integration.create etc. = by-design) or the hardcoded-host fetches (location.searchCity -> open-meteo = not attacker-controlled).preg_replace('/[^\x09\x20-\x7E]/','',$content) allowlist-strip at the API entry, protecting every downstream record-type validator. A fresh scout re-surfaces already-closed chains because it lacks our memory. Always grep bounty/findings + lessons-library for the target/CVE before spending an audit (reinforces [[feedback_shortlist_crossref_findings_first]] + [[feedback_complete_degraded_gate_before_regreenlight]]).path audit option. But OpenBao's file-audit backend NEVER had that guard on EITHER option - so there is no asymmetry/regression to port-lag, just a uniformly-absent defense-in-depth (and enabling audit devices is already root-privileged). "Guard-skipped-on-legacy-path" (real port-lag) vs "guard-never-existed-here" (N-A) is the distinction; do not force a port-lag finding from a feature that was never ported at all. [[feedback_cross_fork_portlag_primitive]]For an SSRF/traversal incomplete-fix: read whether the fix is a SHARED chokepoint guard (WALK) or PER-ENDPOINT rebinding (dig the un-rebound siblings). And before digging any scout-surfaced advisory, cross-ref our own findings/lessons - a "hot" advisory may be a chain we already closed.