Authorizations are not properly verified when creating projects or trackers from projects marked as templates.
Users can get access to information in those template projects because the permissions model is not properly enforced.
CVSSv3.1 score: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- As a non member of a private template project create a new project from it
- As a user that cannot see a tracker in a template project, create a new tracker from it