Most recent entries from all

DRUPAL-CONTRIB-2025-093

Affected: Packagist:https://packages.drupal.org/8: drupal/config_pages

This module enables you to access an edit page for a config page.

The module doesn't sufficiently check the access permissions (`hook_ENTITY_TYPE_access()` wasn't taken into account).

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" and that it only affects sites that have access restricted via the `hook_ENTITY_TYPE_access()` hook.

EUVD-2026-350583

fkie_cve-2025-8361

Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.

This issue affects Config Pages: from 0.0.0 before 2.18.0.

GHSA-w63x-4vj8-p867

Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.This issue affects Config Pages: from 0.0.0 before 2.18.0.

WID-SEC-W-2025-1684 — Drupal: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsmaßnahmen zu umgehen und Cross-Site-Scripting-Angriffe durchzuführen.