Threats tagged 'ghsa-m7m2-vv7w-5553'

Craft CMS versions from 5.10.0 up to but not including 5.11.2 contain an authorization bypass vulnerability. This flaw allows authenticated users with low privileges to browse volumes they should not have access to. Specifically, attackers can delete a linked asset and then use the replacement volume browser modal to view directory structures of all volumes, although they cannot view file contents.