CVE-2024-13278

The Drupal Diff module (versions prior to 1.8.0 ) contains an incorrect authorization vulnerability. The flaw stems from the module failing to sufficiently check revision access before rendering a diff report for nodes or general entities that support diff. A remote attacker who possesses the per...

CVE-2026-73478

Drupal Diff is a contrib module that enables viewing differences between revisions on any entity type. It contains an Incorrect Authorization flaw that allows forceful browsing : the module does not sufficiently restrict access to non-node entity revision diffs . The practical impact is that a us...