DRUPAL-CONTRIB-2022-051
This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance.
The module doesn't sufficiently check access for the add operation. Users with permission to edit content can view and reference unpublished terms. The edit form may expose term data that users could not otherwise see, since there is no term view route by default.
This vulnerability is slightly mitigated by the fact that an attacker must have a role with the permission "access content", so may not be accessible to anonymous users on all sites.
What each source reports
OSV No score
This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance.
The module doesn't sufficiently check access for the add operation. Users with permission to edit content can view and reference unpublished terms. The edit form may expose term data that users could not otherwise see, since there is no term view route by default.
This vulnerability is slightly mitigated by the fact that an attacker must have a role with the permission "access content", so may not be accessible to anonymous users on all sites.
- Record
DRUPAL-CONTRIB-2022-051- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/tagifyPackagist:https://packages.drupal.org/8 |
before 1.0.5 | 1.0.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-051 is a vulnerability with no CVSS score yet in drupal/tagify, published July 27, 2022. No source lists public exploit code. Fixed in drupal/tagify 1.0.5.