CVE-2022-25270

Vulnerability

The Quick Edit module in Drupal core fails to properly check entity access in certain circumstances [1][2]. This affects sites where the QuickEdit module is installed, which is included in the Standard installation profile. Users with the "access in-place editing" permission can exploit this flaw.

Exploitation

An attacker needs only the "access in-place editing" permission, which is typically granted to certain roles. By using the Quick Edit functionality, the attacker can view content that they are not authorized to access [1][2]. No additional authentication or network position is required beyond having the permission.

Impact

Successful exploitation leads to information disclosure: the attacker can view restricted content [1][2]. The confidentiality of the affected content is compromised, but there is no impact on integrity or availability.

Mitigation

The Drupal security advisory SA-CORE-2022-004 provides details on the fix [2]. Administrators should update Drupal core to the patched version as specified in the advisory. Sites using the contributed Quick Edit module should also apply SA-CONTRIB-2022-025 [2]. If unable to update, consider disabling the Quick Edit module as a workaround.