PT-2026-82365

CVE-2026-81161

Published

2026-08-26

Updated

2026-09-24

Description by

CVSS 3.1

3.3

Low

MetricsAV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Content Moderation Notifications versions 0.0.0 through 3.9.0

Description An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators.

Recommendations Update Content Moderation Notifications to a version later than 3.9.0.

Exploitability

Exploit

Fix

Impacts

Researchers