Packagist/drupal/core: unknown

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files.

Action: Upgrade drupal/core to 9.4.12 or later.

composer require drupal/core:9.4.12

composer require drupal/core:9.5.5

composer require drupal/core:10.0.5

Affected

introduced	fixed	last affected
8.0.0	9.4.12	-
9.5.0	9.5.5	-
10.0.0	10.0.5	-

Fixed versions

9.4.12

9.5.5

10.0.5

Sources

osv: DRUPAL-CORE-2023-002
https://www.drupal.org/sa-core-2023-002

published 2023-03-15T16:21:27Z · modified 2026-09-19T18:21:33Z · JSON