MEDIUM4.3

GHSA-4vp3-vfww-8648

Incorrect permission enforcement in UmbracoCms

Quick fix

GHSA-4vp3-vfww-8648 — UmbracoCms: upgrade to the fixed version with the command below.

dotnet add package UmbracoCms --version 8.10.0

Details

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.

Enter the version of the package you're using.

Introduced in: 0Fixed in: 8.10.0

Fixdotnet add package UmbracoCms --version 8.10.0