Vulnerability which can be fixed publicly because it requires an advanced permission

Steps to follow:

1. Grant the module maintainer access to the issue so they will know what is going on.
2. Post this as a comment on the issue (note that "NAME" in the bug report URL below needs to be replaced with the actual project name).

If the report was received via email, do the same things, but via email.

After review, this vulnerability can be fixed publicly as per https://www.drupal.org/security-advisory-policy because it requires the attacker to have advanced permission that already makes the site compromised.

Please file a critical bug report against https://www.drupal.org/node/add/project-issue/NAME?tags=Security%20improvements in the public issue queue.  I'm granting the module maintainers access to this issue for their awareness.

Thank you for reporting this issue to the Drupal security team.

Regards,
{your name} on behalf of the Drupal Security Team