Zeeshaan Khann

An incorrect authorization issue allows forceful browsing, where users without the required permissions can access the bulk update form used for assigning or removing roles on multiple user accounts. This is mitigated by the requirement that an attacker must already possess a role with the "administer users" permission.

An incorrect authorization issue allows forceful browsing. The module renders entity add/edit forms within an AJAX dialog for entity reference fields but relies solely on the "access administration pages" permission. It fails to verify if the current user possesses the necessary create or update access for the specific entity. This issue is mitigated if the attacker does not have a role assigned with the "access administration pages" permission.

An incorrect authorization issue allows forceful browsing. The module provides a Generate internal links action for the AI CKEditor toolbar, enabling editors to search for relevant site content to link to. The search query fails to respect entity access when returning results to the browser. This issue is mitigated by the requirement that a user must have permission to use the AI CKEditor Generate internal links feature on a text format.

A missing authorization issue allows forceful browsing. The module fails to sufficiently protect the '/css-usage-analyzer/save' endpoint against forged or repeated submissions, which could allow a frontend scanner to post unauthorized CSS-usage measurements to the site.