DRUPAL-CONTRIB-2026-238
DRUPAL-CONTRIB-2026-238
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled. This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain.
Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
drupal/domain Packagist:https://packages.drupal.org/8
- Betroffene Versionsbereiche
- ECOSYSTEM: < 3.0.2
Auf 3.0.2 aktualisieren