David Stoline

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.