4.7.26

#10236 Require a signed response before storing update bulletins
#10237 Update Underscore to 1.13.8 to close CVE-2026-27601
#10238 Stop Redis SORT from locking up the online list - Simplified online list removing online location and guests.
#10239 Stop building ORDER BY from the raw table sort parameter
#10240 Stop compiling Pages address text as template source
#10241 Encode stream titles, failed admin logins and Commerce history notes
#10242 Bind an MFA pass to the member who completed it
#10243 Redeem a gift card only if its purchase row is still there
#10244 Use the verified PayPal sale for webhook amounts
#10245 Encode the quoted author name in GraphQL comment quotes
#10246 Require ownership before a GraphQL attachment delete
#10247 Only import image files as badge and rank icons
#10248 Require package edit permission to preview a package email
#10249 Check the ACP restriction on actions that were only gated by the module
#10250 Derive forced password reset links from a per-site secret
#10251 Stop linking a login method when the member cannot reauthenticate
#10252 Require the template permission before saving theme template source
#10253 Require the designer mode permission to change designer mode
#10254 Bind theme template selectors instead of concatenating them into SQL
#10255 Keep widget custom CSS from closing the style element
#10256 Omit calendars the member cannot read from event search
#10258 Stop signing XenForo proxy.php image URLs into redirects
#10259 Refuse comments from another topic in the multimod merge
#10260 Enforce album privacy when an album is viewed or embedded
#10261 Block original image URLs from GraphQL responses where applicable
#10262 Check attachment permission before serving database storage URLs
#10263 Require the template permission for compiled theme CSS and header HTML
#10264 Backport the end-of-life critical security fixes
#10266 Refuse to link a PayPal subscription that is not approved
#10267 Require a comment or review to belong to the item in the URL
#10269 Claim pending attachments by the post key for this session
#10270 Refuse executable names when a theme resource is imported
#10271 Keep used authenticator codes until their TOTP step has passed
#10273 Bind a passed CAPTCHA to this session and this challenge
#10274 Reject an over-long host before Punycode encoding it
#10275 Stop a restricted administrator from merging an administrator account
#10278 Refuse deletion of another member's unmapped editor attachment

These security related issues have been responsibly reported to us or identified via internal audits.

Thanks to:

Aria Akhavan for reporting the following issues found during their audit.

#10236, #10240, #10243, #10244, #10245, #10246, #10247, #10248, #10249, #10250, #10251, #10252, #10253, #10254, #10255, #10256, #10258, #10259, #10261, #10262, #10263, #10264, #10266, #10267, #10269, #10271, #10273, #10274, #10275

@Colonel_mortis for reporting

#10242, #10264, #10269

Lucas Brönner for reporting

#10278, #10251

Undisclosed customer for reporting

#10239