Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker with the Manage Users permission can prevent legitimate users, including administrators, from accessing the platform by modifying usernames to cause account lockouts or username takeovers. Workaround...

CVE-2025-55301

The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the account's username locally. This issue has been patched in version 1.1...