-
Notifications
You must be signed in to change notification settings - Fork 5.8k
Open
Description
The Brevo plugin configuration endpoint does not verify whether the current user has the MANAGE_PLUGINS permission.
As a result, users without this permission can still access the configuration page directly via URL.
This behavior may lead to unauthorized access to plugin configuration settings.
Steps to Reproduce:
- Create a new role.
- Assign Admin area access to the role.
- Ensure the role does NOT have the MANAGE_PLUGINS permission.
- Log in with a user assigned to this role.
- Manually navigate to: https://{YOUR_DOMAIN}/Admin/Brevo/Configure
Actual Result
The Brevo configuration page is displayed successfully.
Expected Result
Access should be denied.
Suggested Fix
Add a permission check for MANAGE_PLUGINS in the Brevo plugin configuration controller/action.
