ulsklyc/yuvomi v2.66.1

on GitHub

Security

• A member's module permissions now hold for every letter case of an API path
  (GHSA-cvwj-hx37-3r7m). The API routes /api/v1/Notes to the same place as /api/v1/notes,
  but the check that enforces per-member module access compared the path letter for letter, found
  no module for the capitalised spelling and let the request through. A member set to "no access"
  for a module could read it that way, and a member with read-only access could write to it. This
  affected every module since per-member module access arrived in v1.4.0; admins and members
  without restrictions were never limited by it. Scoped API tokens were never let through, but were
  refused for a capitalised path to a module they may use - that now works as well.