Edit Mode: Layout editor publishes page for a user without publish permission

Problem Statement

A limited user without publish permission can cause a page to be published through the layout editor — a permission bypass / privilege-escalation defect.

When a user who has edit (but not publish) permission on a page enters edit mode, adds already-published content to the page, and then changes the page layout, the page gets published — including the content the limited user just added. The user's lack of publish permission is not enforced on the layout-change path.

• Impact: limited authors can push content live without the publish rights that are supposed to gate that action. This is a governance/permissions integrity issue, not cosmetic.
• Reported by: Aptar (via Ian Cooper).
• Front-end issue — occurs in Edit Mode / Layout Editor.

Steps to Reproduce

Video screencast: https://drive.google.com/file/d/1tQN4JRIEtBRVUpUcEIkyWqdLiXfaychw/view?usp=sharing

Detailed steps:

1. Create a limited user with all edit permissions but no publish permission.
2. Log in as that user and open any page in edit mode.
3. Add a new piece of published content to the page.
4. Go to the layout editor and change the layout of the container the content was added to.
5. Open the published version of the page — it was published with the new content added by the limited user.

Acceptance Criteria

• A user without publish permission cannot cause a page to be published via a layout change (or any edit-mode action).
• Changing a page layout as a no-publish user saves to the working/draft version only — the live version is unchanged.
• Permission enforcement on the layout-change path matches the rest of the edit-mode publish gating.

dotCMS Version

Reported on a customer (Aptar) environment; version not captured in the original report — please confirm current-version reproducibility. Reproduce against latest main.

Severity

High - Major functionality broken

Links

• Asana (Product Feedback): https://app.asana.com/1/10691720482678/project/1211899269219810/task/1211904959400572
• Slack/Freshdesk: NA

Start with the Edit Mode and Layout Editor entry points described in the issue, then reproduce the steps against the latest main branch using a user with edit but no publish permission. Trace the layout-change path and compare it with existing edit-mode publish gating; done means the layout change updates only the working or draft version and leaves the live page unchanged.