Security Review and 4.0.1 Release

jonesde · September 1, 2026, 6:47pm

In the spirit of paranoia and panic that is going around, I finally decided to go for it and drop a couple of days and a few million tokens specifically into Moqui security.

This is not a random probe sort of effort, though I did some of that as well with multiple LLMs. The primary effort is in two parts:

thorough documentation of the framework attack surface in SECURITY_SURFACE.md
a considerable library of security-specific proof tests using both Spock for internal ones and Python/PyTest for testing a Moqui server externally; this is used to validate the framework, and could be adapted for production system validation as well

There are enough small changes that I believe it warrants a patch level release in the near future, so I’ve added a section to ReleaseNotes.md for an upcoming 4.0.1 release:

github.com/moqui/moqui-framework

ReleaseNotes.md

master

# Moqui Framework Release Notes

## Release 4.0.1 - Not Yet Released

Moqui Framework 4.0.1 is a patch follow-up to 4.0.0. It includes a more
thorough AI-assisted security review with SECURITY_SURFACE.md documentation
and two new test suites (Spock and external Python; see SECURITY_TESTS.md).

Please update to this release or backport changes. If backporting, contact a
Board Member for more information to ensure full coverage.

To help with review of deployments, the SECURITY_SURFACE.md doc consolidates
and clarifies security details that have been more scattered and less formal.

### XML Screen transition authorization

- Added `transition.@authz-action` (`view`, `create`, `update`, `delete`, `all`).
  Transitions are authorized for that action when they run and when links check
  whether they are permitted. They are no longer always treated as VIEW.
  - Default if omitted: a transition-level `service-call` uses that service's

This file has been truncated. show original

There were enough small issues that I highly recommend with updating to the latest from git, or back-porting these changes if you are using an older or more custom version of Moqui Framework.

There was nothing that, to me anyway, seemed worth escalating for emergency updates or something, but there are a small number of issues that could be real issues on production systems that are not sufficiently “locked down” or that are not using a well-configured web-app firewall (WAF).

I don’t think any of these are major issues for well-configured and WAF-protected deployments, but assuming that is the case and just disclosing everything is NOT my call to make. Those on the Moqui Board will be notified in more detail and we will review when and what to disclose, but please don’t take this as some sort of emergency, just an extra note of caution where I am not as confident in how certain Moqui-based production systems are actually deployed.

In short: please take advantage of these new resources to better secure your Moqui-based systems. There is enough in here that it is worth doing a pass on that now.