Zugriffsumgehung in Drupal Core

The vulnerability stems from incorrect form element access evaluation within Drupal Core. This allows unauthorized users to modify data they should not be permitted to change. The specific impact depends on the data accessible through the affected forms. A successful attack could lead to unauthorized modifications of user accounts, content, or other critical site data. The potential for data corruption and unauthorized access makes this a significant concern.

1. Reserviert2022-02-16
2. Veröffentlicht2023-04-26
3. Geändert2025-02-03
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade Drupal Core to version 9.3.19 or later. Before upgrading, review all custom modules and forms for potential access control vulnerabilities. Implement strict access control policies and regularly audit user permissions. Consider using a Web Application Firewall (WAF) to detect and block suspicious requests. After the upgrade, confirm access controls are functioning as expected by testing various user roles and permissions.