Jen M

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify user permissions when creating specific media types if the bulk upload form is configured for those types. Exploitation requires the attacker to possess a role with the "bulk upload form" permission.

The Drupal Material Icons module has an authorization issue. Insufficient permissions are added to dialog and autocomplete routes, potentially granting full access to these routes in many situations. This allows for forceful browsing. The module is designed to add icons to CKEditor.