GHSA-WR57-HQMP-FGVH Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public unprotected node references a protected node through a Content Picker or Multi-Node Tree Picker including those nested inside Block List,...