GHSA-44cp-9fph-8778: 
PHP vulnerability analysis and mitigation

Summary

An authenticated Canvas Contributor could read another author's posts, including drafts and scheduled posts, by requesting that author's user id on the user posts endpoint. The posts index already limits Contributors to their own posts. This endpoint did not.

Impact

Missing authorization for an authenticated read. A Contributor who knows another host user id could read that author's unpublished post content. An anonymous visitor could not read those posts, and the Contributor could not change them. The endpoint now returns 403 unless the signed-in user is that author or may view every author's posts. Contributors still receive their own posts. Editors and Admins still receive another author's posts. Fixed in 7.2.8.

Credit

Reported by @ruslanty.