Hyunseo Shin

Backend users with access to the Recycler module can restore soft-deleted records on pages or for tables they are not authorized to modify.

Backend users can move records to a different page even if they lack the necessary edit permissions on the source page.

Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) through the Media Module. Because the fallback storage resolves paths relative to the server's document root, this can lead to the exposure of sensitive files, such as log files.