Adam Bramley

An issue exists where user-specific access rules are not sufficiently guarded against malformed saved configurations. Under specific site conditions, an access rule designed to restrict submission access to selected user accounts may inadvertently grant access to anonymous users. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

Insufficient permission checks for webform and webform submission entities when retrieving webform elements or fields allow for forceful browsing. This occurs within the module used to retrieve and submit webforms via REST.

An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This requires the attacker to possess a role with permission to view the entity.

A privilege escalation issue exists in the Role Delegation module. The module allows site administrators to grant specific roles the authority to assign selected roles to users, without needing the 'administer permissions' permission. A vulnerability allows a user with the ability to delegate a role to also assign the administrator role, even to their own user account. This is possible when the module is used with the Views Bulk Operations module and an attacker has access to a view of users with the Views Bulk Operations module enabled.

A flaw exists in the CivicTheme Design System that allows for Cross-Site Scripting (XSS). This occurs due to improper neutralization of input during web page generation. The issue impacts the way user-supplied data is handled, potentially allowing attackers to inject malicious scripts into web pages viewed by other users.

The issue is related to an incorrect authorization vulnerability in the Diff module of the Drupal content management system. This vulnerability allows for functionality misuse. A remote attacker may exploit this issue to gain access to confidential information.