CVSS: 8.6
Affected versions: 22.0.0 - 31.8.4
Category: Authentication
A high-severity vulnerability was identified in the administration interface user account recovery flow. Under specific circumstances, the application could accept information from a less trusted source when performing security-sensitive operations, potentially resulting in unauthorized administrative access.
Xperience by Kentico SaaS instances are not affected.
Update to version 31.9.0 or newer. See Update Xperience by Kentico projects for detailed instructions.
If you cannot update immediately, configure the service domain for system emails to the domain where you host the administration interface using the SystemEmailOptions.ServiceDomain configuration key.
This issue was reported by Ahmed Ibrahim.
CVSS: 7.1
Affected versions: 30.0.0 - 31.8.4
Category: IDOR
An authorization issue in the Content hub application could allow an authenticated user with permissions in one workspace to view limited metadata of content items in other workspaces, and under specific circumstances move a content folder into a workspace they were not assigned to. The issue was not reproducible through conventional admin UI operations.
Update to version 31.9.0 or newer. See Update Xperience by Kentico projects for detailed instructions.
This issue was reported by Ahmed Ibrahim.