Publify `guest` role users can self-register even when the admin does not allow it

2021-11-0317:34:22

Google

osv.dev

0.001 Low

EPSS

Percentile

26.9%

JSON

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.

CPENameOperatorVersion
publify_coreeq9.2.3
publify_coreeq9.0.0.pre4
publify_coreeq9.2.1
publify_coreeq9.0.0.pre6
publify_coreeq9.0.0.pre5
publify_coreeq9.2.0
publify_coreeq9.2.2
publify_coreeq9.2.4
publify_coreeq9.0.0.pre1
publify_coreeq9.0.0

Name	Operator	Version
publify_core	eq	9.2.3
publify_core	eq	9.0.0.pre4
publify_core	eq	9.2.1
publify_core	eq	9.0.0.pre6
publify_core	eq	9.0.0.pre5
publify_core	eq	9.2.0
publify_core	eq	9.2.2
publify_core	eq	9.2.4
publify_core	eq	9.0.0.pre1
publify_core	eq	9.0.0