This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+9 more
Affected surfaces
Summary
AI summaryFixed cross‑tenant data leak when writing custom fields on chat action approval.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | High |
Scope custom-field writes to the action's tenant on approval, preventing cross-tenant data leak and 504 timeouts. Scope custom-field writes to the action's tenant on approval, preventing cross-tenant data leak and 504 timeouts. Source: llm_adapter@2026-06-09 Confidence: high |
— |
Full changelog
Fixes
Chat: Scope custom-field writes to the action's tenant on approval (#320)
Action approvals run through the /chat/actions/* routes, which bypass Filament's panel middleware and therefore leave no tenant context. Without one, the custom-fields TenantScope no-ops and saveCustomFields() iterates every tenant's field definitions — writing custom-field value rows across all tenants (cross-tenant data leak) and, at scale, exceeding the request timeout (504). PendingActionService::approve() now sets the tenant context from the action's team before executing the write and restores the prior context afterward, so the override never outlives the call.
Full Changelog: https://github.com/relaticle/relaticle/compare/v3.3.2...v3.3.3
Security Fixes
- Prevented cross‑tenant write of custom‑field values during action approval by scoping writes to the action's tenant.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About relaticle
Open-source CRM with native AI agent support. 30 MCP tools, REST API, self-hosted. Built with Laravel & Filament
Related context
Beta — feedback welcome: [email protected]