Threats tagged 'ghsa-59jw-q7p7-3pgg'

A vulnerability exists where a user with the Editor role who can edit a folder can move that folder under another folder they administer using the folders resource API. This action grants the user Admin rights on the moved folder and its contents, including permission to change access controls. The legacy folder move API prevents this move due to improper privilege management in the newer API.