GHSA-86xw-vmcx-9mj4
Drupal Content moderation Access bypass
In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass.
What each source reports
GitHub AdvisoriesNo score
Drupal Content moderation Access bypass
In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass.
- Record
GHSA-86xw-vmcx-9mj4- Updated
- 2026-11-02
OSVNo score
Drupal Content moderation Access bypass
In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass.
- Record
GHSA-86xw-vmcx-9mj4- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/drupalPackagist | 8.0.0 up to 8.5.8 | 8.5.8 |
drupal/drupalPackagist | 8.6.0 up to 8.6.2 | 8.6.2 |
drupal/drupalPackagist | 8.0.0 up to 8.5.8, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 | 8.5.8 |
drupal/drupalPackagist | 8.6.0 up to 8.6.2, plus listed versions 8.6.1 | 8.6.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-86xw-vmcx-9mj4 is a vulnerability with no CVSS score yet in drupal/drupal, published May 15, 2024. No source lists public exploit code. Fixed in drupal/drupal 8.5.8.
References
Left out here: 22 versions. The JSON record has them.