CVE-2022-25278

CVE-2022-25278 is an access bypass vulnerability in Drupal core's Form API. Under certain conditions, the API evaluates form element access incorrectly, which may allow a user to modify data they should not have access to [2]. The issue does not affect forms provided by Drupal core itself, but custom or contributed modules and themes that define forms may be vulnerable [4].

To exploit this vulnerability, an attacker likely needs to have a user account with some level of access, as the flaw lies in how access checks are evaluated for form elements. The attack surface is limited to forms that implement custom access logic, making exploitation dependent on the specific implementation [2].

If successfully exploited, an attacker could alter data in ways that bypass intended permissions, potentially leading to privilege escalation or data corruption. The severity is rated moderately critical by Drupal's security team [4].

Mitigation is available through updates: Drupal 9.4 users should upgrade to 9.4.3, and Drupal 9.3 users to 9.3.19. All earlier versions of Drupal 9 and 8 are end-of-life and do not receive security coverage. Drupal 7 is not affected [4].