Threats tagged 'ghsa-7v2f-gh7j-2mfr'

Pagelayer versions before 2.2.1 contain a missing authorization vulnerability in the Abilities API. This flaw allows contributor-level attackers to perform unauthorized actions such as overwriting, publishing, deleting, or duplicating other users' private posts and pages, as well as modifying site-wide theme templates like headers and footers.