CVE-2026-81842: Library panel can be moved into a folder without library panel create permission
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user needs edit permission on a folder they control and the ability to move a library panel through the library elements API or equivalent App Platform resource. They do not need library panel create permission on the destination folder; view permission there is sufficient.
What is the practical impact on the destination folder?
An attacker can place a library panel into a folder where they otherwise have only view permission. The issue does not disclose destination-folder data and does not allow modification of existing content in that folder.
How can I determine whether this affected my environment?
Review library panel moves performed through the library elements API or equivalent App Platform resource for cases where the actor had view-only access to the destination folder and lacked library panel create permission there.