Jigar Bhanushali

**Name of the Vulnerable Software and Affected Versions** Multicollab: Content Team Collaboration and Editorial Workflow versions prior to 5.3 **Description** A missing capability check in the `cf add comment()` function allows authenticated attackers with Subscriber-level access or higher to perform unauthorized modification of data by adding comments to arbitrary collaborations. **Recommendations** Update to a version later than 5.2. As a temporary workaround, restrict access to the `cf add comment()` function for users with Subscriber-level permissions.