—0.0
GHSA-335x-5wcm-8jv2
Backoffice User can bypass "Publish" restriction
Quick fix
GHSA-335x-5wcm-8jv2 — Umbraco.CMS: upgrade to the fixed version with the command below.
dotnet add package Umbraco.CMS --version 8.18.10Details
#### Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios.
#### Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request body of the "Send for Approval" request.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/Umbraco.CMS
Introduced in:
8.0.0Fixed in: 8.18.10Fix
dotnet add package Umbraco.CMS --version 8.18.10NuGet/Umbraco.CMS
Introduced in:
9.0.0Fixed in: 10.8.0Fix
dotnet add package Umbraco.CMS --version 10.8.0NuGet/Umbraco.CMS
Introduced in:
11.0.0Fixed in: 12.3.0Fix
dotnet add package Umbraco.CMS --version 12.3.0