Jason Stephenson

**Name of the Vulnerable Software and Affected Versions** Evergreen versions prior to 2.5.9 Evergreen versions 2.6.x prior to 2.6.7 Evergreen versions 2.7.x prior to 2.7.4 **Description** The issue allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings. This is due to the failure of `open-ils.actor.ou setting.ancestor default` to enforce `view perm` when no authentication token is provided. **Recommendations** For versions prior to 2.5.9, update to version 2.5.9 or later. For versions 2.6.x prior to 2.6.7, update to version 2.6.7 or later. For versions 2.7.x prior to 2.7.4, update to version 2.7.4 or later.