DRUPAL-CORE-2023-002

En bref

Publiée: 2023-03-15 16:21 UTC
Mise à jour: 2026-09-19 18:21 UTC

Description

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with [SA-CONTRIB-2023-010](https://www.drupal.org/sa-contrib-2023-010). This advisory is not covered by [Drupal Steward](/steward).

Paquets affectés

Paquet	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 9.4.12 ; introduced 9.5.0, fixed 9.5.5 ; introduced 10.0.0, fixed 10.0.5

Références

https://www.drupal.org/sa-core-2023-002 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence