CVE-2026-104881

Channel access is enforced ONLY by the DataContainer voters "NewsletterChannelAccessVoter" / "NewsletterRecipientsAccessVoter", requiring USERCANEDITCHANNEL, whose "supportsType" fires exclusively for Create/Read/Update/DeleteAction subjects dispatched inside DCTable's create/edit/delete methods...