Engineering / ENG-1835
Pen test M2: administrator invitations can be re-sent without a limit
Description
From the penetration test report received on Friday, 23 October (Confluence SEC › Penetration test 2026): no critical or high findings, three medium, four low. This is M2, medium.
"Resend invitation" has no limit; it can be used to flood someone's mailbox from our domain. Limit to three an hour per invitation and ten an hour per administrator. Due 20 November.
Comments (0)
No comments.