Alexei Rayu

An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This requires the attacker to possess a role with permission to view the entity.