---
title: Security advisory 2024-11-21
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Insecure direct object reference (IDOR) in Form Builder

**CVSS**: 5.3\
**Affected versions**: 22.0.0 - 29.7.0\
**Category**: IDOR

### Summary

A vulnerability in the Form Builder's authorization layer permitted the use of direct URLs created for another administration user's [Form Builder](https://docs.kentico.com/documentation/business-users/digital-marketing/forms/create-and-edit-forms.md) context, which could potentially enable unauthorized modification of forms. However, this misuse would require the attacker to obtain the URL from an authorized user by some means, as the URL is generated by the server.

### How to fix

Update to the latest version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.