Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-x2q9-r8gm-f657

GitHub Security Advisory

Drupal Core Access bypass vulnerability

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

Affected Packages

Packagist drupal/core
Affected versions: 8.8.0 (fixed in 8.8.10)
Packagist drupal/core
Affected versions: 8.9.0 (fixed in 8.9.6)
Packagist drupal/core
Affected versions: 9.0.0 (fixed in 9.0.6)
Packagist drupal/drupal
Affected versions: 8.8.0 (fixed in 8.8.10)
Packagist drupal/drupal
Affected versions: 8.9.0 (fixed in 8.9.6)
Packagist drupal/drupal
Affected versions: 9.0.0 (fixed in 9.0.6)

Related CVEs

CVE-2020-13667

Key Information

GHSA ID
GHSA-x2q9-r8gm-f657
Published
May 24, 2022 7:02 PM
Last Modified
April 23, 2024 10:30 PM
CVSS Score
5.0 /10
Primary Ecosystem
Packagist
Primary Package
drupal/core
GitHub Reviewed
✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.