Hdwsec

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).

The backend module for reviewing consent history fails to validate sorting, grouping, and index options received in requests before using them in a database query. While filter conditions are bound as parameters, the lack of validation for other options allows a backend user with access to history or statistics functions to perform unauthorized reads of arbitrary database data, including password hashes for both backend and frontend users.

Several AJAX routes used for the backend localization wizard lack proper authorization checks. This allows authenticated users with low privileges to access information regarding records and content elements that are outside their permitted access range.

A stored cross-site scripting issue exists where radio and toggle field option labels are rendered using the Twig `|raw` filter. This allows attackers with form authoring permissions to inject HTML and script payloads into option labels, which then execute in the browsers of administrators and visitors who view the form.