What's Changed
🔒 Security
- Resolved backoffice users can grant user groups start nodes outside their own access (start node restriction bypass) from GHSA-r4qv-c8pg-qq59
- Resolved start-node restrictions not enforced on URL, imaging and reference lookups from GHSA-xqwv-jvcm-5vjq
- Resolved stored XSS chained with path traversal in Umbraco CMS media management from GHSA-88p9-4pxf-pq3c
- Resolved backoffice logout does not invalidate the auth cookie (session not ended server-side) from GHSA-4qmm-fhgv-vq9g
- Resolved unpublished content exposed through website preview and the Delivery API from GHSA-24m3-86rh-6888
- Resolved website preview session did not expire from GHSA-4vcm-wj6q-3pmg
- Resolved backoffice account takeover via sign-in redirect manipulation in Umbraco CMS from GHSA-rpv9-qp4c-g469
Full Changelog: release-18.2.1...release-18.2.2