Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.
Sites that do not have the JSON:API module enabled are not affected.
CVE-2020-13677
This vulnerability affects the following application versions:
- Drupal 8.8.0
- Drupal 8.8.1
- Drupal 8.8.2
- Drupal 8.8.3
- Drupal 8.8.4
- Drupal 8.8.5
- Drupal 8.8.6
- Drupal 8.8.7
- Drupal 8.8.8
- Drupal 8.8.9
- Drupal 8.8.10
- Drupal 8.8.11
- Drupal 8.8.12
- Drupal 8.9.0
- Drupal 8.9.1
- Drupal 8.9.2
- Drupal 8.9.3
- Drupal 8.9.4
- Drupal 8.9.5
- Drupal 8.9.6
- Drupal 8.9.7
- Drupal 8.9.8
- Drupal 8.9.9
- Drupal 8.9.10
- Drupal 8.9.11
- Drupal 8.9.12
- Drupal 8.9.13
- Drupal 8.9.14
- Drupal 8.9.15
- Drupal 8.9.16
- Drupal 8.9.17
- Drupal 8.9.18
- Drupal 9.0.0
- Drupal 9.0.1
- Drupal 9.0.2
- Drupal 9.0.3
- Drupal 9.0.4
- Drupal 9.0.5
- Drupal 9.0.6
- Drupal 9.0.7
- Drupal 9.0.8
- Drupal 9.0.9
- Drupal 9.0.10
- Drupal 9.0.11
- Drupal 9.0.12
- Drupal 9.0.13
- Drupal 9.0.14
- Drupal 9.1.0
- Drupal 9.1.1
- Drupal 9.1.2
- Drupal 9.1.3
- Drupal 9.1.4
- Drupal 9.1.5
- Drupal 9.1.6
- Drupal 9.1.7
- Drupal 9.1.8
- Drupal 9.1.9
- Drupal 9.1.10
- Drupal 9.1.11
- Drupal 9.1.12
- Drupal 9.2.0
- Drupal 9.2.1
- Drupal 9.2.2
- Drupal 9.2.3
- Drupal 9.2.4
- Drupal 9.2.5