UNKNOWNDRUPAL-CORE-2023-002
DRUPAL-CORE-2023-002
Platform
drupal
Component
drupal
Fixed in
9.4.12
The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with [SA-CONTRIB-2023-010](https://www.drupal.org/sa-contrib-2023-010). This advisory is not covered by [Drupal Steward](/steward).
How to fix
No official patch available. Check for workarounds or monitor for updates.
Monitor your dependencies automatically
Get notified when new vulnerabilities affect your projects. Free forever.
Start free