Packagist/drupal/core CVE-2020-13677: unknown, EPSS 1.22%

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.

Action: Upgrade drupal/core to 8.9.19 or later.

composer require drupal/core:8.9.19

composer require drupal/core:9.1.13

composer require drupal/core:9.2.6

Affected

introduced	fixed	last affected
8.0.0	8.9.19	-
9.1.0	9.1.13	-
9.2.0	9.2.6	-

Fixed versions

8.9.19

9.1.13

9.2.6

Sources

osv: DRUPAL-CORE-2021-010
https://www.drupal.org/sa-core-2021-010

CVE-2020-13677 · published 2021-09-15T15:25:10Z · modified 2026-09-19T17:49:53Z · JSON