CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13243

The Drupal Entity Delete Log module (versions 0.0.0 through 1.1.1 ) contains a missing authorization vulnerability that facilitates Forceful Browsing . The root cause is that the module fails to add sufficient permissions to the log report page, which tracks deleted entity types like nodes or com...