Access Control Vulnerability in Drupal Core JSON:API by Drupal

CVE-2020-13677

Summary

The Drupal Core JSON:API module has a vulnerability where it fails to adequately restrict access to certain content under specific conditions. This flaw could allow unauthorized users to bypass access controls and gain access to restricted content. Only sites with the JSON:API module enabled are at risk. To assure the security of your Drupal site, it is critical to review the module's permissions and take necessary updates as advised by security advisories.

References