Please, before disclosing any vulnerability, report it privately through GitHub private vulnerability reporting. Do not open a public issue or discussion for it.

If private reporting is unavailable, email security@syspass.org.