GHSA-73q4-j324-2qcc

Incorrect authorization in Drupal core

En bref

Publiée: 2022-02-18 00:00 UTC
Mise à jour: 2025-12-10 23:41 UTC
CVE: CVE-2022-25270
Alias: BIT-drupal-2022-25270, DRUPAL-CORE-2022-004
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Paquets affectés

Paquet	Versions
Packagist · drupal/core	introduced 9.3.0, fixed 9.3.6
Packagist · drupal/core	introduced 8.0.0, fixed 9.2.13

Références

https://nvd.nist.gov/vuln/detail/CVE-2022-25270 ADVISORY
https://www.drupal.org/sa-core-2022-004 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database