Cristiano Demari

An incorrect authorization issue in the entity merge functionality allows forceful browsing. The module does not sufficiently restrict access to entity management operations, enabling users with content viewing permissions to delete arbitrary nodes, taxonomy terms, or media entities.

The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests, leading to a Cross-Site Request Forgery (CSRF) issue. This allows an attacker to trick an authenticated user into performing unintended actions. This issue is only present if the `advanced filesystem backup` module is enabled.