Servers and applications
CVE-2016-7570 Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
Severity Medium 4.3
Published 3 Oct 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.7% in the next 30 daysHigher than 77% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · Needs a user account · No user action needed
Attacker can Read some data
CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Sources NVD Affected software Software Affected versions DrupalServers and applications · cpe:a:drupal:drupal Version 8.1.9 Version 8.1.8 Version 8.1.7 Version 8.1.6 All 52 release lines Version 8.0.0-alpha2 Version 8.0.0-alpha3 Version 8.0.0-alpha4 Version 8.0.0-alpha5 Version 8.0.0-alpha6 Version 8.0.0-alpha7 Version 8.0.0-alpha8 Version 8.0.0-alpha9 Version 8.0.0-alpha10 Version 8.0.0-alpha11 Version 8.0.0-alpha12 Version 8.0.0-alpha13 Version 8.0.0-alpha14 Version 8.0.0-alpha15 Version 8.0.0-beta1 Version 8.0.0-beta2 Version 8.0.0-beta3 Version 8.0.0-beta4 Version 8.0.0-beta6 Version 8.0.0-beta7 Version 8.0.0-beta9 Version 8.0.0-beta10 Version 8.0.0-beta11 Version 8.0.0-beta12 Version 8.0.0-beta13 Version 8.0.0-beta14 Version 8.0.0-beta15 Version 8.0.0-beta16 Version 8.0.0-rc1 Version 8.0.0-rc2 Version 8.0.0-rc3 Version 8.0.0-rc4 Version 8.0.0 Version 8.0.1 Version 8.0.2 Version 8.0.3 Version 8.0.4 Version 8.0.5 Version 8.0.6 Version 8.1.0-beta1 Version 8.1.0-beta2 Version 8.1.0-rc1 Version 8.1.0 Version 8.1.1 Version 8.1.2 Version 8.1.3 Version 8.1.4 Version 8.1.5 Version 8.1.6 Version 8.1.7 Version 8.1.8 Version 8.1.9
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-7570 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-7570