-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper logical operator usage in access control checks. The commit diff shows the critical change from orIf() to andIf() in bypassAccessResult(), which directly addresses the access bypass flaw. The accompanying test modification in WorkspaceBypassTest.php confirms the behavioral change from allowing (200) to denying (403) access when users have the bypass permission but don't own the workspace. No other functions in the patch demonstrate security-relevant changes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | > 8.7.3, < 8.7.5 | 8.7.5 |
| drupal/drupal | composer | > 8.7.3, < 8.7.5 | 8.7.5 |
PHPPHPOngoing coverage of React2Shell