Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Drupal sites may let users view restricted content revisions

CVE-2022-25274 · published 3 years ago
Summary

If your website runs Drupal and uses the built‑in revision system for pages or media, a recent change can let people who normally can edit revisions see versions of content they shouldn’t be allowed to view. This could expose draft or archived information to unintended users. Update Drupal to the latest release and verify that revision permissions are correctly configured to stop the exposure.

What to do
  • Update drupal core to version 9.3.12.
  • Update drupal drupal/core to version 9.3.12.
  • Update drupal drupal to version 9.3.12 or later.
Affected software
Ecosystem VendorProductAffected versions
composer drupal core >= 9.3.0, < 9.3.12
Fix: upgrade to 9.3.12
– drupal drupal >= 9.3.0, < 9.3.12
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Packagist drupal drupal/core >= 9.3.0, < 9.3.12
Fix: upgrade to 9.3.12
Original advisory text
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for user...
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published26 Apr 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-7jr4-hgqx-vwgq · GHSA
CVE-2022-25274 · NVD
DRUPAL-CORE-2022-009 · OSV
CVE-2022-25274 · OSV
Track software like this
Free during beta