Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the renderobjectstructure function. An attacker can access sensitive page content by sending requests to the structure endpoint with the content-type id and object id of a view-restricted page. This is only...

CVE-2020-26231

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 fixed in 1.0.469 and 1.1.0 was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.managepages, cms.managelayouts, or...

GHSA-94VP-RMQV-5875 Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

Impact An authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig...