Threats tagged 'ghsa-v2qf-q3h8-xpm7'

REDAXO versions before 5.21.4 have a broken access control vulnerability that allows authenticated editors to modify slices in categories they are not authorized to access. By pairing a permitted article with a foreign slice ID, attackers can abuse content editing, deletion, and slice status or movement APIs to delete, toggle, move, or overwrite slices belonging to other editors.