Sven Decabooter

The module fails to sufficiently validate image style names during the generation of image derivatives. This allows anonymous users to generate image derivatives without a valid token, which can lead to excessive resource allocation and a denial of service. The issue exists regardless of whether combined image styles are configured or in use. This is limited to public files, as derivatives of private files remain protected by the core token check.

The module fails to sufficiently redact the content of logged emails. Consequently, account-related emails are stored with their one-time login links intact. An attacker with the `View Drupal Symfony Mailer log entries` permission can access these links to gain unauthorized access to any account, including the administrative account (user 1). This occurs because the permission was not marked as restricted in earlier releases.

An authorization flaw in the AI Translate submodule allows forceful browsing. The module fails to sufficiently verify access permissions for entities, related fields, or referenced entities during the AI translation process, particularly when these components have different access levels than the parent entity. This results in a permission bypass specifically for the translation operation, although it does not grant unauthorized read or update access to the affected entities.

An authorization flaw allows forceful browsing within the module used for automatic entity translation. The system fails to sufficiently verify access permissions for the entity being translated, its related fields, or referenced entities when performing an AI translation, particularly when these components have different access levels than the parent entity. This results in a permission bypass limited strictly to the translation operation, without granting unauthorized read or update access to the affected entities.

Improper handling of case sensitivity allows privilege escalation. The module fails to ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under specific database collation configurations. This issue primarily affects sites using certain MySQL or MariaDB collation settings for the authentication mapping storage.

An improper check for unusual or exceptional conditions exists in Drupal core, allowing for forceful browsing. This issue impacts the software's ability to handle unexpected input or situations, potentially leading to unauthorized access or information disclosure.

The issue affects Drupal core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.