See attached debdiff
diff -Nru glewlwyd-2.5.2/debian/changelog glewlwyd-2.5.2/debian/changelog
--- glewlwyd-2.5.2/debian/changelog 2021-09-22 08:42:59.000000000 -0400
+++ glewlwyd-2.5.2/debian/changelog 2021-12-17 07:51:46.000000000 -0500
@@ -1,3 +1,9 @@
+glewlwyd (2.5.2-2+deb11u2) bullseye; urgency=medium
+
+ * d/patches: Fix possible privilege escalation (Closes: #1001849)
+
+ -- Nicolas Mora <babelou...@debian.org> Fri, 17 Dec 2021 07:51:46 -0500
+
glewlwyd (2.5.2-2+deb11u1) bullseye; urgency=medium
* d/patches: Fix CVE-2021-40818
diff -Nru glewlwyd-2.5.2/debian/patches/auth.patch
glewlwyd-2.5.2/debian/patches/auth.patch
--- glewlwyd-2.5.2/debian/patches/auth.patch 1969-12-31 19:00:00.000000000
-0500
+++ glewlwyd-2.5.2/debian/patches/auth.patch 2021-12-17 07:51:46.000000000
-0500
@@ -0,0 +1,16 @@
+Description: Fix escalation privilege
+Author: Nicolas Mora <babelou...@debian.org>
+Forwarded: not-needed
+--- a/src/webservice.c
++++ b/src/webservice.c
+@@ -259,10 +259,6 @@
+ if (check_result_value(j_result, G_ERROR_UNAUTHORIZED)) {
+ y_log_message(Y_LOG_LEVEL_WARNING, "Security - Authorization
invalid for username %s at IP Address %s",
json_string_value(json_object_get(j_param, "username")), ip_source);
+ }
+- if ((session_uid = get_session_id(config, request)) != NULL &&
user_session_update(config, session_uid, u_map_get_case(request->map_header,
"user-agent"), issued_for, json_string_value(json_object_get(j_param,
"username")), NULL, 1) != G_OK) {
+- y_log_message(Y_LOG_LEVEL_ERROR, "callback_glewlwyd_user_auth -
Error user_session_update (2)");
+- }
+- o_free(session_uid);
+ response->status = 401;
+ }
+ json_decref(j_result);
diff -Nru glewlwyd-2.5.2/debian/patches/series
glewlwyd-2.5.2/debian/patches/series
--- glewlwyd-2.5.2/debian/patches/series 2021-09-22 08:42:59.000000000
-0400
+++ glewlwyd-2.5.2/debian/patches/series 2021-12-17 07:51:46.000000000
-0500
@@ -1,2 +1,3 @@
#webpack.patch
webauthn.patch
+auth.patch
