GitHub Advisoryadvisory · Packagist

GHSA-86xw-vmcx-9mj4 Drupal Content moderation Access bypass

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: drupal/drupal
Severity: Moderate
Reviewed: 2024-05-15

Affected packages

• Packagist drupal/drupal: >= 8.0.0, < 8.5.8 → fixed in 8.5.8 • Packagist drupal/drupal: >= 8.6.0, < 8.6.2 → fixed in 8.6.2

Description

In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass.

References