DRUPAL-CONTRIB-2026-238

DRUPAL-CONTRIB-2026-238

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled. This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain.

Corrección disponible

Publicación

2026-10-21T17:50:53Z

Actualización

2026-10-21T18:15:04.033437691Z

Pila tecnológica: php

Comprueba tu servidor →