-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient access control in JSON:API's write operations when read_only is disabled. Key functions in the request handling flow (ResourceController::handle) and access checking layer (ResourceResponseSubscriber::checkAccess) were identified as likely culprits based on: 1) The CWE-863 (Incorrect Authorization) classification, 2) The requirement for read/write mode to be active, and 3) Drupal's security advisory indicating missing access checks during request processing. These components directly manage operation permissions and would be responsible for enforcing write access controls when read_only=FALSE.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 8.8.0, < 8.8.8 | 8.8.8 |
| drupal/core | composer | >= 8.9.0, < 8.9.1 | 8.9.1 |
| drupal/core | composer | >= 9.0.0, < 9.0.1 | 9.0.1 |
| drupal/drupal | composer | >= 8.8.0, < 8.8.8 | 8.8.8 |
| drupal/drupal | composer | >= 8.9.0, < 8.9.1 | 8.9.1 |
| drupal/drupal | composer | >= 9.0.0, < 9.0.1 | 9.0.1 |
KEV Misses 88% of Exploited CVEs- Get the report