DRUPAL-CONTRIB-2020-003
Views Bulk Operations provides enhancements to running bulk actions on views.
The module contains an access bypass vulnerability that might allow users to execute views actions that they should not have access to.
This vulnerability is mitigated by the fact that it only occurs in the case of customised action access (by means of hook_action_info_alter).
What each source reports
OSVNo score
Views Bulk Operations provides enhancements to running bulk actions on views.
The module contains an access bypass vulnerability that might allow users to execute views actions that they should not have access to.
This vulnerability is mitigated by the fact that it only occurs in the case of customised action access (by means of hook_action_info_alter).
- Record
DRUPAL-CONTRIB-2020-003- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/views_bulk_operationsPackagist:https://packages.drupal.org/8 | before 2.6.0, 3.0.0 up to 3.4.0 | 2.6.03.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2020-003 is a vulnerability with no CVSS score yet in drupal/views_bulk_operations, published February 5, 2020. No source lists public exploit code. Fixed in drupal/views_bulk_operations 2.6.0.