Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios.

Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request body of the "Send for Approval" request.

Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

or

Serve all media from an different host (e.g cdn) that where umbraco is hosted

Impact A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended.

Explanation of the vulnerability A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message.