DRUPAL-CORE-2021-009

At a glance

Published: 2021-09-15 15:23 UTC
Updated: 2026-09-19 17:48 UTC
CVE: CVE-2020-13676
Aliases: BIT-drupal-2020-13676, GHSA-qfhg-m6r8-xxpj

Description

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. This advisory is not covered by [Drupal Steward](/steward).

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 8.9.19 ; introduced 9.1.0, fixed 9.1.13 ; introduced 9.2.0, fixed 9.2.6

References

https://www.drupal.org/sa-core-2021-009 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence