Security advisory: IBEXA-SA-2024-001

The Taxonomy tree controller fails to apply permission checks in one case. This means someone who already has backend access but no access to taxonomy tags, can still see taxonomy tags and identifiers by crafting a manual request. Installations that use taxonomy tags and have backend users without taxonomy access may be affected.

This vulnerability was reported to us by Matthias Schmidt from adesso SE at https://www.adesso.de/
We thank them for their research, and responsibly disclosing the issue to us.