Brian Osborne

**Name of the Vulnerable Software and Affected Versions** Content Moderation Notifications versions 0.0.0 through 3.9.0 **Description** An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators. **Recommendations** Update Content Moderation Notifications to a version later than 3.9.0.

**Name of the Vulnerable Software and Affected Versions** Disable Login Page versions 0.0.0 through 1.1.4 **Description** An authentication bypass exists because the module fails to invalidate relevant caches when login page access restrictions are enabled. This allows previously cached responses for the `/user/login` endpoint to remain accessible, enabling an attacker to bypass the functionality intended to restrict access to the login page. **Recommendations** Clear the system caches after enabling login page access restrictions to ensure that cached responses for the `/user/login` endpoint are invalidated.

**Name of the Vulnerable Software and Affected Versions** Disable Login Page versions *.* **Description** A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.