Threats tagged 'ghsa-rw7p-j29f-9hjr'

Craft CMS versions from 5.0.0 up to but not including 5.11.2 contain an authorization bypass vulnerability. This flaw allows anonymous GraphQL clients to access section entries that should be restricted by chaining navigation through prev/next fields. Sensitive data such as titles, slugs, and custom-field content from withheld sections can be enumerated and read by unauthorized users.