Threats tagged 'ghsa-j6f9-3wr6-g69x'

REDAXO versions before 5.21.4 have a missing authorization vulnerability in the media pool bulk move feature. The vulnerability arises because the system only checks permissions on the target category and ignores the source category. Authenticated backend users with permission on one media category can move files from restricted categories into their permitted category and replace their contents silently across the site.