{"id":"CVE-2019-6342","aliases":["DRUPAL-CORE-2019-008","EUVD-2019-15903","GHSA-xq62-62c9-22mg","UBUNTU-CVE-2019-6342"],"status":"published","title":"Drupal core - Critical - Access bypass - SA-CORE-2019-008","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02202,"percentile":0.82666,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2019-07-17T16:05:11Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["8.7.5"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"drupal/drupal","fixed_in":["8.7.5"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"UNPARSED","raw":"\u003e 8.7.3, \u003c 8.7.5","events":[{"fixed":"8.7.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"UNPARSED","raw":"\u003e 8.7.3, \u003c 8.7.5","events":[{"fixed":"8.7.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.7.4"},{"fixed":"8.7.5"}]}],"versions":["8.7.4"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.7.4"},{"fixed":"8.7.5"}]}],"versions":["8.7.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.38-1","7.41-1","7.44-1ubuntu1~16.04.0","7.44-1ubuntu1~16.04.0+esm1","7.44-1ubuntu1~16.04.0+esm2","7.44-1ubuntu1~16.04.0+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"},{"vendor":"drupal","product":"drupal core"}],"references":[{"url":"https://www.drupal.org/sa-core-2019-008","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6342","tags":["advisory"]},{"url":"https://github.com/drupal/core/commit/bac9bde22bb545ff72570d8a46055c6c6e70e7c5","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6342.yaml"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6342.yaml"},{"url":"https://github.com/advisories/GHSA-xq62-62c9-22mg"},{"url":"https://github.com/drupal/core","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2019-6342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6342","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-6342","title":"Drupal core - Critical - Access bypass - SA-CORE-2019-008","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","status":"published","published":"2020-05-28T20:59:46Z","modified":"2024-08-04T20:23:20.932Z","updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-15903","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","status":"published","published":"2020-05-28T20:59:46Z","modified":"2024-08-04T20:23:20Z","updated_at":"2026-11-03T03:06:49.204502Z"}],"ghsa":[{"id":"GHSA-xq62-62c9-22mg","title":"Drupal Improper Access Control","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","status":"published","published":"2024-01-11T15:43:15Z","modified":"2024-02-05T10:55:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:35.293818Z"}],"nvd":[{"id":"CVE-2019-6342","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","status":"published","published":"2020-05-28T21:15:11.373Z","modified":"2026-06-17T02:39:02.807Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:47.558959Z"}],"osv":[{"id":"CVE-2019-6342","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","status":"published","published":"2020-05-28T21:15:11.373Z","modified":"2026-10-24T10:30:49.799310829Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"GHSA-xq62-62c9-22mg","title":"Drupal Improper Access Control","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","status":"published","published":"2024-01-11T15:43:15Z","modified":"2025-12-10T23:41:17.020713Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"UBUNTU-CVE-2019-6342","description":"An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.","status":"published","published":"2020-05-28T21:15:00Z","modified":"2025-09-08T16:45:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DRUPAL-CORE-2019-008","description":"In Drupal 8.7.4, when the [experimental](https://www.drupal.org/core/experimental#beta) Workspaces module is enabled, an access bypass condition is created.\n\nThis can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.\n\nDrupal 8.7.3 and earlier, Drupal 8.6.x and earlier, and Drupal 7.x are **not** affected.","status":"published","published":"2019-07-17T16:05:11Z","modified":"2026-09-19T19:22:51Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}