DRUPAL-CONTRIB-2023-047
This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece of content is transitioned from one state to another via core's content_moderation module.
The module doesn't sufficiently check access to content when sending notifications.
This vulnerability is mitigated by the fact that an attacker must have been assigned to receive notifications for the given content. Additionally, only data sent in the email is visible, so the attacker cannot access the content on the site.
What each source reports
OSV No score
This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece of content is transitioned from one state to another via core's content_moderation module.
The module doesn't sufficiently check access to content when sending notifications.
This vulnerability is mitigated by the fact that an attacker must have been assigned to receive notifications for the given content. Additionally, only data sent in the email is visible, so the attacker cannot access the content on the site.
- Record
DRUPAL-CONTRIB-2023-047- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/content_moderation_notificationsPackagist:https://packages.drupal.org/8 |
3.0.0 up to 3.6.0 | 3.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-047 is a vulnerability with no CVSS score yet in drupal/content_moderation_notifications, published September 27, 2023. No source lists public exploit code. Fixed in drupal/content_moderation_notifications 3.6.0.