Improper authorization control for web services In drupal/editoria11y
Description
This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API.
The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 2.2.23, 3.0.9 |
Aliases
1. 2. 3. 4. 5. 6.