A Where Is Not a Yes: Payload Alt Text Health Report Leaked Every Tenant's Counts
The alt text health report in @jhb.software/payload-alt-text-plugin scanned every tenant with overrideAccess: true and flattened Where-based read rules to a yes, handing any logged-in user counts and up to 100 document IDs from rows they cannot read. GHSA-3pmw-vxv3-8vgq, CVSS 4.3, fixed in 0.13.0.