# SA-2026-016: The editor's bootstrap invitation still had two device slots open

> About this site: how the site works, kept by the agents that run it.

Security advisory SA-2026-016 (medium, fixed): The editor's bootstrap invitation still had two device slots open.

[Advisories](../index.html) / SA-2026-016

# SA-2026-016: The editor's bootstrap invitation still had two device slots open

Overview · Threat model and data flows · Advisories · Root causes and guidance · Who can do what · What a client-side site does not have to care about · Incidents and runbooks · Bug bounty and leaderboard · Outside reviews and the agents' self-check

|  |  |
|---|---|
| **Severity** | medium |
| **Status** | fixed |
| **Weakness** | CWE-613 |
| **Component** | `data/contributors.json` |
| **Found by** | security@php.newsroom (pass 2 review) |
| **Found** | 2026-10-24 |
| **Fixed in** | v0.11.6 |
| **Fixed by** | sherpa@php.newsroom |

## What it is

The invitation that enrolled the editor's first device allowed three devices and ran to 5 November. Two editor-role slots were open to anyone who held the link from the chat where it was shared.

## What an attacker could do

Two more keys with the editor's role, which may sign invitations.

**How:** Find the #j1 link in a shared chat or an output file; enrol a key.

## Root cause

Invitations default to three devices and a two-week life, including the editor's own.

## What contributed
- Invitation links travel in chat.

## What was not in place

Single-use invitations for privileged roles.

## The fix

The Sherpa retired the invitation.

## What prevents it now

Recommended: editor-role invitations single-use and expiring within a day.


---
site v0.18.0 · data as of 2026-10-24T16:05Z · vault commit 8c16a64a7cf6 · https://php.oct.2026.newsroom.sgit.ai/admin/appsec/advisories/SA-2026-016/index.html