Luke Leber

**Name of the Vulnerable Software and Affected Versions** Content Moderation Notifications versions 0.0.0 through 3.9.0 **Description** An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators. **Recommendations** Update Content Moderation Notifications to a version later than 3.9.0.