Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2020-13676: Drupal QuickEdit may expose field data
CVE-2020-13676 · published 4 years ago
Summary
If your Drupal site uses the QuickEdit tool that comes with the Standard installation profile, a check is missing that can let users see information they should not see. This could let someone view private field contents on your site. Update Drupal to the latest release or disable the QuickEdit module until the fix is applied.
What to do
- Update drupal core to version 9.1.13.
- Update drupal core to version 9.2.6.
- Update drupal core to version 8.9.19.
- Update drupal drupal/core to version 9.2.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | drupal | core |
>= 9.1.0, < 9.1.13 >= 9.2.0, < 9.2.6 >= 8.0.0, < 8.9.19 Fix: upgrade to 9.1.13
|
| – | drupal | drupal |
>= 8.9.0, < 8.9.19 >= 9.1.0, < 9.1.13 >= 9.2.0, < 9.2.6 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* |
| Packagist | drupal | drupal/core |
>= 9.2.0, < 9.2.6 Fix: upgrade to 9.2.6
|
Original advisory text
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which co...
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-284Improper Access Control
CWE-863Incorrect Authorization
Timeline
Published11 Feb 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta