Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013

Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access Bypass Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25278 Description: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes…

Drupal Security Advisoriesで読む