Luke Leber

A security issue exists in the Drupal ECA Helper project. The Drupal Security Team has marked this project as unsupported because the maintainer has not provided a fix for the known issue.

An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators.