Backoffice User can bypass "Publish" restriction

Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request...

CVE-2023-48227 Umbraco CMS Backoffice User can bypass "Publish" restriction

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a...

PT-2018-16196 · Mosquitto · Aedes

Name of the Vulnerable Software and Affected Versions: aedes versions prior to 0.35.1 Description: The issue is related to improper authorization, where aedes does not respect its own authorization rules when a client sets a Last Will. This can lead to publishing a Last Will and Testament LWT in ...