A Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows for forceful browsing. This issue affects versions from 0.0.0 up to 2.2.0. Users may be able to access restricted content without proper authorization.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-8996 |
Exploitation
To exploit this vulnerability, an attacker can leverage the missing authorization checks in the Layout Builder Advanced Permissions module to access or manipulate content that should be restricted. This can be done by crafting specific requests that bypass the intended access controls.
Affected Products
- Layout Builder Advanced Permissions: A module that allows for advanced permission settings in Drupal, affected from version 0.0.0 to 2.2.0.
Mitigation
To mitigate this vulnerability, it is recommended to update the Layout Builder Advanced Permissions module to the latest version where the issue has been resolved. Additionally, review and adjust permission settings to ensure proper access controls are in place.