Threats tagged 'ghsa-f7g4-vhhq-7w9x'

REDAXO core versions before 5.21.4 have a missing authorization vulnerability in the structure/version and structure/history frontend preview modes. These modes fail to verify category or clang permissions for the previewed article, allowing any backend user or users with the history[article_rollback] permission to access unpublished, historic, or deleted content by manipulating preview parameters.