CVE-2026-68541: PolicyPress: Sensitive content disclosed via CSS-only web redaction and insecure starter workflow defaults
PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive content is disclosed via CSS-only web redaction and insecure starter workflow defaults. This issue has been patched in version 1.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.1
Event History
Frequently Asked Questions
Which deployments need to be updated?
PolicyPress deployments running versions earlier than 1.4.1 are affected. The issue is patched in version 1.4.1.
Are default workflows implicated?
Yes. The issue includes insecure starter workflow defaults, so deployments using starter workflows should be treated as potentially affected.
What information could be exposed?
Sensitive content may be disclosed where web redaction relies only on CSS. CSS-only redaction does not remove the underlying content from the page.