Finding ID: SEC-021
Location: lib/Security/User.php
CVSS: 3.7
getRoles() returns only ['ROLE_USER'] for all users, disconnecting Symfony role system from application groups and preventing integration with other bundles expecting standard roles.
Impact: Permission model inconsistencies; third-party bundles misbehave.
Remediation (short): Map group codes to Symfony roles (e.g., add ROLE_ADMIN/ROLE_SUPER_ADMIN for super admin groups) and return unique roles.
Reference: SECURITY_REVIEW.md
Finding ID: SEC-021
Location: lib/Security/User.php
CVSS: 3.7
getRoles()returns only['ROLE_USER']for all users, disconnecting Symfony role system from application groups and preventing integration with other bundles expecting standard roles.Impact: Permission model inconsistencies; third-party bundles misbehave.
Remediation (short): Map group codes to Symfony roles (e.g., add
ROLE_ADMIN/ROLE_SUPER_ADMINfor super admin groups) and return unique roles.Reference: SECURITY_REVIEW.md