v4.5.0.7
shivangi-aneja/GaussianSpeechv4.5.0.7Jun 22, 2026by sid-swirl
AI Summary
A critical security patch addressing privilege escalation vulnerabilities in OIDC sign-in and Microsoft token fallback handling.
Key Highlights
- Fixed OIDC privilege escalation by preventing superuser provisioning
- Fixed cross-user Microsoft token fallback to strictly scope to the requesting user
New Features
- Security hardening for OIDC
- Security hardening for M365 tokens
Full Release Notes
SWIRL Community 4.5.0.7 — Security Patch Fixes [#1941](https://github.com/swirlai/swirl-search/issues/1941): * OIDC privilege escalation: sign-in no longer provisions superuser/staff accounts, and no longer sets a shared hardcoded password. * Cross-user Microsoft token fallback: M365 token lookup is now strictly scoped to the requesting user; removed the fallback that could use another user's credentials. No schema or dependency changes. Upgrade recommended for any deployment using OIDC sign-in or M365 connectors.