Packagist/drupal/core CVE-2022-25278: unknown, EPSS 0.59%

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to.

Action: Upgrade drupal/core to 9.3.19 or later.

composer require drupal/core:9.3.19

composer require drupal/core:9.4.3

Affected

introduced	fixed	last affected
8.0.0	9.3.19	-
9.4.0	9.4.3	-

Fixed versions

9.3.19

9.4.3

Sources

osv: DRUPAL-CORE-2022-013
https://www.drupal.org/sa-core-2022-013

CVE-2022-25278 · published 2022-07-20T15:35:43Z · modified 2026-09-19T18:16:23Z · JSON