medium6.5
CVE-2022-25278
Access bypass in Drupal Core
Impact
Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | drupal/core | >= 8.0.0, < 9.3.19 | 9.3.19 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | from 8.0.0 before 9.3.19 from 9.4.0 before 9.4.3 |