When using private files in combination with certain field access modules, the File module would allow users to download the file even if they did not have access to view the field it was attached to.
Part of security release SA-CORE-2012-001
This vulnerability affects the following application versions:
- Drupal 7.0
- Drupal 7.1
- Drupal 7.2
- Drupal 7.3
- Drupal 7.4
- Drupal 7.5
- Drupal 7.6
- Drupal 7.7
- Drupal 7.8
- Drupal 7.9
- Drupal 7.10