sympa is vulnerable to authorization bypass. The vulnerability exists as remote attackers can obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020
github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md
github.com/sympa-community/sympa/issues/1041
github.com/sympa-community/sympa/pull/1044
lists.debian.org/debian-lts-announce/2020/12/msg00026.html
lists.fedoraproject.org/archives/list/[email protected]/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/
lists.fedoraproject.org/archives/list/[email protected]/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/
security-tracker.debian.org/tracker/CVE-2020-29668
www.debian.org/security/2020/dsa-4818