GHSA-6gjf-7w99-j7x7
Deleted Admin Can Sign In to Admin Interface
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | october/october | >= 2.1.0, < 2.1.12 | 2.1.12 |
| Packagist | october/system | >= 2.1.0, < 2.1.12 | 2.1.12 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0.
### Patches
The issue has been patched in v2.1.12
### Workarounds
- Reset the password of the deleted accounts to prevent them from signing in.
- Please contact [email protected] for code change instructions if you are unable to upgrade.
### References
Credits to:
• Daniel Bidala
### For more information
If you have any questions or comments about this advisory:
* Email us at [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.