@blackvoid before anyone is panicking:

"This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong."

should not be that urgent, at least not in the selfhosting realm