Brian Osborne

This module implements a client-side accessibility checker that automatically reports results to dashboard views via an API. A privilege escalation issue exists because a permission was incorrectly described as a view permission, while it actually grants edit and delete access to module data, leading to a potential access bypass.

An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators.

An authentication bypass exists because the module fails to invalidate relevant caches when login page access restrictions are enabled. This allows previously cached responses for the `/user/login` endpoint to remain accessible, enabling an attacker to bypass the functionality intended to restrict access to the login page.

A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue.