GHSA-73q4-j324-2qcc

Incorrect authorization in Drupal core

At a glance

Published: 2022-02-18 00:00 UTC
Updated: 2025-12-10 23:41 UTC
CVE: CVE-2022-25270
Aliases: BIT-drupal-2022-25270, DRUPAL-CORE-2022-004
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 9.3.0, fixed 9.3.6
Packagist · drupal/core	introduced 8.0.0, fixed 9.2.13

References

https://nvd.nist.gov/vuln/detail/CVE-2022-25270 ADVISORY
https://www.drupal.org/sa-core-2022-004 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database