Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.

Affected Packages

Packagist drupal/core

Affected versions: 8.8.0 (fixed in 8.8.8)

Packagist drupal/core

Affected versions: 8.9.0 (fixed in 8.9.1)

Packagist drupal/core

Affected versions: 9.0.0 (fixed in 9.0.1)

Packagist drupal/drupal

Affected versions: 8.8.0 (fixed in 8.8.8)

Packagist drupal/drupal

Affected versions: 8.9.0 (fixed in 8.9.1)

Packagist drupal/drupal

Affected versions: 9.0.0 (fixed in 9.0.1)

Related CVEs

CVE-2020-13665

Key Information

GHSA ID

GHSA-wxqp-jwc9-g39x

Published

May 24, 2022 5:49 PM

Last Modified

April 23, 2024 10:30 PM

CVSS Score

9.0 /10

Primary Ecosystem

Packagist

Primary Package

drupal/core

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.