Skip to content

1.4.7

Choose a tag to compare

View all tags
@rhukster rhukster released this 25 Jul 20:24
· 16 commits to master since this release
1.4.7
45516e2
This commit was signed with the committer’s verified signature.
rhukster Andy Miller
GPG key ID: 9F2CF38AEBDB0AE0
Verified
Learn about vigilant mode.

Bugfix

  • [security] A user with delegated user-management permission can no longer reset another account's password or grant it super-admin access by editing the account through the generic Flex Objects write endpoint, which skipped the checks the dedicated user and group endpoints apply; user and group records must now be changed through those dedicated endpoints (GHSA-pc8m-jxvh-vmrc).
Assets 2
Loading