Users can perform actions without the proper permissions

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 5.1 EE SP4 (5.1.7), 5.2 EE SP3 (5.2.7)
• Fix Version/s: 5.1 EE SP5 (5.1.8), 5.2 EE SP4 (5.2.8)
• Component/s: Application Security
• Labels:
  • 5.2_release_notes
• Environment: All

There is a security issue with PrincipalThreadLocal and PermissionThreadLocal which could allow a user to perform actions without the proper permissions. These two thread locales are not always reset, as a result, subsequent users could inherit the permission of the previous user.