#28700 Security gap in workflow transitions - Unauthorized processing after task completion

Enhancement

Major

#28593

Baumselektions-Modell mit Teilbaum-Selektionslogik

#28695

Selektionsfilter für (Tree-)tables und -grids im Layout-Editor einstellen

#28704

Optimized access to table FLEX_DATA for some DBs

Detail

#28613

"DefaultFor" Konfigurationsoption im "advanceProcess"-Template für BPE

#28679

Dynamic labels for FormTableDefinition

#28705

Close Formlar dialogs on Cancel

#28712

Test can set whether warnings lead to failure

Nice to have

#28588

Option to mark tables in forms as non-selectable

Bugfix

Major

#28673

Vulnerability in commons-beanutils (CVE-2025-48734)

#28675

Opening Excel-Scripts in Script Recorder fails when starting from command line

#28676

Securing Kafka client configuration against SSRF and file reads (CVE-2025-27817)

#28684

DoS vulnerability in Apache Commons FileUpload (CVE-2025-48976)

#28692

ClassCastException in the ActiveTaskComponent

#28700

Security gap in workflow transitions - Unauthorized processing after task completion

#28739

TL script method filterPermission must not be evaluated at compile time

Detail

#28331

Incorrect update type creation in tUpdate leads to ignoring of hidden attribute changes

#28617

Bug: Post-Create-Actions fehlen bei Prozess-Start ohne Prüfung

#28640

Mandatory Multiline fields do not have a blue line

#28665

Calculated attributes are not updated when tables are changed

#28666

Fehlender DisplayContext nach BinaryDataSource-Conversion

#28667

Pipe closed Error when sending mail due to double rendering of content without EncodingAware interface

#28671

ExcelWriter methods are missing

#28686

REST routing: Shorter paths are prioritized over longer paths and cause incorrect route matching

#28690

Create in currency administration has wrong command group

#28698

Executability rule is checked on deleted object

#28706

Form tables exceed container width

#28707

Falsches Dirty-Handling im SelectTransitionDialog (BPE)

#28724

Selection filter must not be evaluated on deleted objects

#28726

Unique-Constraint-Violation bei mehrfacher Anwendung des MoveObjectsProcessor

Nice to have

#28458

Falsche Abfrage, ob Komponente Multi-Selektion unterstützt

Bugfix

Major

#28700

Security gap in workflow transitions - Unauthorized processing after task completion

If a user completes a task during edit mode and forwards the workflow, they automatically end up back in edit mode of the original ActiveTaskComponent, even though they may not have edit permissions for the new workflow state. This allows unauthorized editing in workflow states where the user should have read-only access.

Solution: Implement an authorization check after workflow transition that automatically switches to view mode if the user does not have edit permissions for the new state.