Access Bypass

Drupal is vulnerable to access bypass which allows attackers to see all views. This vulnerability occurs because the pages accessible by Ajax are not limited to the ones configured to be so. This allows attackers to use the filter parameter and the Ajax endpoint to view pages that they shouldn’t be able to see. If you have access restrictions configured on the view, you are not affected.