AIKIDO-2025-10293

TL;DR

Affected versions of this package fail to disable or hide UI actions properly (e.g., adding comments, resolving/unresolving threads) for users without the necessary permissions. An attacker can exploit this issue by interacting with seemingly available actions despite lacking proper authorization, potentially leading to manipulating thread states or adding reactions, disrupting discussions, and misusing privileged functions.