Ahmed Bouhuolia
7efac090a9
Resolve a CLS middleware in App.module.ts to copy the request `organization-id` header straight into `cls.organizationId`, which the TenancyDB factory used to pick the per-tenant database. The JWT path never set `organizationId` from the authenticated user, and TenancyGlobalGuard only checked that the header was present — so any authenticated user could read or write another tenant's database by sending their own JWT plus the victim's `organization-id`. Make the JWT-resolved tenant the source of truth and validate the header at the edge: - AuthSigninService.verifyPayload now loads the user's tenant and sets `cls.organizationId` from `tenant.organizationId`, mirroring the API-key path in AuthApiKeyAuthorizeService. - TenancyGlobalGuard rejects with `Organization mismatch.` when the request header disagrees with the CLS value set by the auth guard. - App.module.ts no longer seeds `cls.organizationId` from the attacker-controlled request header. GHSA-2g96-86rw-qmvg Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Simple, smart online accounting software for small and medium businesses.
What's Bigcapital?
Bigcapital is a smart and open-source accounting and inventory software, Bigcapital keeps all business finances in right place and automates accounting processes to give the business powerful and intelligent financial statements and reports to help in making decisions.
Getting Started
We've got serveral options on dev and prod depending on your need to get started quickly with Bigcapital.
Self-hosted
Bigcapital is available open-source under AGPL license. You can host it on your own servers using Docker.
Docker
To get started with self-hosted with Docker and Docker Compose, take a look at the Docker guide.
Development
Local Setup
To get started locally, we have a guide to help you.
Gitpod
- Click the Gitpod button below to open this project in development mode.
- This will open and configure the workspace in your browser with all the necessary dependencies.
Headless Accounting
You can integrate Bigcapital API with your system to organize your transactions in double-entry system to get the best financial reports.
Resources
- Documentation - Learn how to use.
- API Reference - API reference docs
- Contribution - Welcome to any contributions.
- Discord - Ask for help.
- Bug Tracker - Notify us new bugs.
Changelog
Please see Releases for more information what has changed recently.
Contact us
Meet our sales team for any commercial inquiries.
Recognition
Contributors
Thanks goes to these wonderful people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!