26 matches found
CVE-2026-114553
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114541
Cross-Site Request Forgery CSRF vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
EUVD-2026-113532
Cross-Site Request Forgery CSRF vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114541 Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240
Cross-Site Request Forgery CSRF vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114541 Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240
Cross-Site Request Forgery CSRF vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114541
Cross-Site Request Forgery CSRF vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114541
The Frontend Editing module for Drupal (versions 0.0.0 to 1.9.3 ) is vulnerable to Cross-Site Request Forgery (CSRF) . The module fails to sufficiently protect routes used to delete and reorder paragraphs on rendered pages. An attacker could trick a logged-in editor with sufficient permissions in...
CVE-2026-114553 Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114553
The Drupal Frontend Editing module (versions 0.0.0 to 1.9.3 ) is vulnerable to an incorrect authorization issue that allows Forceful Browsing . The root cause is that the module fails to sufficiently check field access permissions when users add, edit, or delete paragraph items in entity referenc...
CVE-2026-114553
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
EUVD-2026-113531
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114553 Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114553: Drupal Frontend Editing: Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
CVE-2026-114541: Drupal Frontend Editing: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery
Cross-Site Request Forgery CSRF vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...
Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that ...
Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery CSRF. An attacker could trick an editor into visiting a crafted link, which...
PYSEC-2026-3823 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
SummaryThe django-cms frontend-editing structure endpointGET //admin/cms/placeholder/object//structure//did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a model...
