CVE-2023-32725

Fixed in a distro release EPSS <1%CVSS 9.6

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.