Packagist/drupal/core CVE-2022-25270: unknown, EPSS 0.77%

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not author

Action: Upgrade drupal/core to 9.2.13 or later.

composer require drupal/core:9.2.13

composer require drupal/core:9.3.6

Affected

introduced	fixed	last affected
8.0.0	9.2.13	-
9.3.0	9.3.6	-

Fixed versions

9.2.13

9.3.6

Sources

osv: DRUPAL-CORE-2022-004
https://www.drupal.org/sa-core-2022-004

CVE-2022-25270 · published 2022-02-16T16:46:24Z · modified 2026-09-19T18:08:04Z · JSON