JSON:API PATCH requests could bypass validation for certain fields.
By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the read_only set to FALSE under jsonapi.settings config were vulnerable.
This vulnerability affects the following application versions:
- Drupal 8.7.0
- Drupal 8.7.1
- Drupal 8.7.2
- Drupal 8.7.3
- Drupal 8.7.4
- Drupal 8.7.5
- Drupal 8.7.6
- Drupal 8.7.7
- Drupal 8.7.8
- Drupal 8.7.9
- Drupal 8.7.10
- Drupal 8.7.11
- Drupal 8.7.12
- Drupal 8.7.13
- Drupal 8.7.14
- Drupal 8.8.0
- Drupal 8.8.1
- Drupal 8.8.2
- Drupal 8.8.3
- Drupal 8.8.4
- Drupal 8.8.5
- Drupal 8.8.6
- Drupal 8.8.7
- Drupal 8.9.0
- Drupal 9.0.0