Bram Driesen

Insecure storage of sensitive information occurs when audio files for speech-to-text requests are written to a single file in the temporary directory and are not deleted after processing. This allows an attacker with read access to the site's temporary directory—potentially via shared hosting or other code exposing temporary files—to retrieve audio data sent by other users for transcription.

An authentication bypass issue exists where the module fails to fully invalidate a solved CAPTCHA session. This allows a protected form that has been submitted once to be submitted again without solving a new challenge. This flaw weakens protection against automated submissions, including login brute-forcing, comment spam, and spam registrations.

Incorrect authorization allows forceful browsing due to insufficient verification of administrative privileges when checking access to protected fields. This allows users assigned a role with the machine name `administrator` (provided it is not flagged as the site's actual administrator role) to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.

This module provides a framework for integrating AI providers and features into Drupal. The issue occurs because the module does not sufficiently sanitize certain HTMX attributes, leading to Cross-Site Scripting (XSS), where malicious scripts can be injected into web pages.

Insecure storage of sensitive information allows for the retrieval of embedded sensitive data. The module fails to sufficiently encrypt the password of the system user utilized during content synchronization, which may allow unprivileged users to view the password. Exploitation requires the attacker to have prior database read access or a database dump of the user data table.

Cross-Site Request Forgery (CSRF) occurs when a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while authenticated. The module fails to sufficiently protect its toggle URL, allowing an attacker to change the publication status of arbitrary content on behalf of the authenticated user.

Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The AI Automator submodule, which enables automatic field population based on other fields, fails to sufficiently verify access to text formats. This allows users to author field data using text formats they are not authorized to use.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access permissions for the entity being toggled when a user with the "Use Fasttoggle" permission submits a request to the toggle URL. This allows a user to change the publication status, promotion, or stickiness of any node or comment, regardless of whether they have the required permissions to update that specific entity, potentially enabling the publication of unpublished drafts they are not authorized to view.

An incorrect authorization issue allows forceful browsing, where users without the required permissions can access the bulk update form used for assigning or removing roles on multiple user accounts. This is mitigated by the requirement that an attacker must already possess a role with the "administer users" permission.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently restrict access to fields configured as Private on entity types that lack an author field (such as a user account or owner). Consequently, these Private fields can be viewed, and if the entity is editable, it can be modified by any user who can view it, including anonymous users. This issue does not affect fields set to Private on nodes, users, media, comments, or other entity types with an author, nor does it affect fields using Custom permissions.

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

An incorrect authorization issue allows forceful browsing when Drupal Commerce is used in conjunction with the JSON:API module. This allows users without proper permissions to access unpublished product variations. This issue specifically affects sites that maintain both published products and unpublished product variations.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently restrict HTML rendering, which enables the execution of malicious scripts under certain conditions. This issue is mitigated by the requirement that an attacker must have access to a text format capable of rendering HTML.

An issue in the AI Chatbot submodule occurs when user input is not sufficiently filtered before being rendered on a web page, leading to Cross-Site Scripting (XSS). This occurs under certain configurations and requires the attacker to have permissions to administer blocks.

Incorrect authorization in the AI module allows resource injection. The module fails to sufficiently validate links under specific conditions, which could lead to the exfiltration of sensitive information to external sites. This occurs when an attacker uses untrusted sources to interact with the module in a manner that produces rendered HTML.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently validate Markdown links under certain conditions, which can lead to the execution of malicious scripts in the user's browser.

Incorrectly configured access control security levels in the AI Search submodule allow the web browser cache to contain sensitive information. While the AI Search backend verifies access for each search result, this check is ignored when Search API caches view results. Consequently, users may see cached search results, such as titles and fields of unpublished or restricted content, if a user with appropriate permissions performed the same search within the cache lifetime. This occurs when the AI Search submodule is enabled and a Search API view uses time-based, tag-based, or combined time and tag-based result caching.

An issue exists in Drupal Patreon that affects the software's security.

An authentication bypass exists in the Drupal Domain Login Restrict module, which is designed to restrict user logins on multi-domain sites to only assigned domains. The module fails to sufficiently enforce these restrictions when a user authenticates via a method other than the standard login form. Exploitation requires the attacker to possess a valid user account and for the "Enable restriction" setting to be active on the Domain settings page. Users granted the "Login to any domain" permission are not impacted.

Drupal Shield fails to sufficiently limit the number of authentication attempts when an anonymous visitor repeatedly submits basic authentication credentials. This allows for brute force attacks against the HTTP basic authentication prompt used to protect non-public sites from being viewed, crawled, or indexed. The risk is reduced if long, randomly generated passwords are used.