Important security update: v5.0.1
Today we shipped GrowthBook v5.0.1, which includes an important security patch.
If you’re
self-hosting GrowthBook without SSO enabled, we recommend upgrading to v5.0.1 as soon as you can. This update also includes a number of other fixes and improvements.
The issue this version fixes allows unauthenticated users to assume an authenticated session. We have seen no evidence of any exploits in the wild.
• Affected: Publicly accessible self-hosted instances without SSO
• Not affected: GrowthBook Cloud and self-hosted deployments using SSO
Full details are available in our
v5.0.1 release notes and
Security Advisory.
DM me if you have any questions.