CVE-2026-81161

Name of the Vulnerable Software and Affected Versions Content Moderation Notifications versions 0.0.0 through 3.9.0

Description An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators.

Recommendations Update Content Moderation Notifications to a version later than 3.9.0.