Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

MSA-26-0029: Missing capability checks in report builder fragment callbacks

Description:       The report builder fragment output callbacks did not verify
that the requesting user had the required capability to
access the requested report, potentially allowing users to
retrieve report data beyond their permitted access.
Issue summary:     Missing capability checks in report builder fragment
callbacks
Severity/Risk:     Minor
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed:    5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by:       Paul Holden
Issue no.:         MDL-84535