DRUPAL-CORE-2023-002

At a glance

Published: 2023-03-15 16:21 UTC
Updated: 2026-09-19 18:21 UTC

Description

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with [SA-CONTRIB-2023-010](https://www.drupal.org/sa-contrib-2023-010). This advisory is not covered by [Drupal Steward](/steward).

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 9.4.12 ; introduced 9.5.0, fixed 9.5.5 ; introduced 10.0.0, fixed 10.0.5

References

https://www.drupal.org/sa-core-2023-002 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence