From c5a547ffc93b86232c345493e40e70230ca72b68 Mon Sep 17 00:00:00 2001 From: ignacionelson Date: Mon, 5 Oct 2026 01:14:23 -0300 Subject: [PATCH] Changelog: invitations stop at a scoped staff member's reach GHSA-phv7-54fm-qh4r --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 09c8d4ec..ef4cebb4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,6 +35,13 @@ we did. It sits at the top of a release for that reason. Older entries call the the account's own address, and using it signs out every other session. Your users need working email for this; if yours cannot send any, an administrator can still set the password for them. +- **A staff member limited to some clients now sees and revokes only their own invitations, and + those into their clients' groups.** Reported by [@sbouabid-sec](https://github.com/sbouabid-sec). + + *Who this affected:* installations using client-scoped staff roles that can create clients, + since 2.5.0. The invitations screen listed every invitation, with names and email addresses, + and let such a staff member revoke any of them. Nothing to do on upgrade. + ## 2.6.0 — 25 September 2026 Mostly fixes: files and folders are easier to tidy, the sign-in pages carry your brand better, and