Vulnerability advisory

CVE-2022-25278

Published Apr 26, 2023Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2022-25278DRUPAL-CORE-2022-013GHSA-cfh2-7f6h-3m85

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 32680a4aef16035fd6c90014761dcad8de628120	`32680a4aef16035fd6c90014761dcad8de628120`
970c1b5cfa946f683de326a3f252b5371a42186a to before bf401c8d5c5a88d442ac7e95a9eb059d123a771c	`bf401c8d5c5a88d442ac7e95a9eb059d123a771c`
Also listed as affected (22) `9.3.18` `9.4.2` `9.3.17` `9.4.1` `9.4.0` `9.3.15` `9.3.13` `9.3.11` `9.3.10` `9.3.7` `9.3.4` `9.3.2` `9.3.0` `9.3.0-rc1` `9.3.0-beta3` `9.3.0-beta2` `9.3.0-beta1` `9.3.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0`

Description

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.

CVE-2022-25278

Affected versions

Repository

Description

References