Servers and applications
CVE-2016-7572 The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Severity Medium 4.3
Published 3 Oct 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.7% in the next 30 daysHigher than 77% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · Needs a user account · No user action needed
Attacker can Read some data
CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Sources NVD Affected software Software Affected versions DrupalServers and applications · cpe:a:drupal:drupal Version 8.1.9 Version 8.1.8 Version 8.1.7 Version 8.1.6 All 52 release lines Version 8.0.0-alpha2 Version 8.0.0-alpha3 Version 8.0.0-alpha4 Version 8.0.0-alpha5 Version 8.0.0-alpha6 Version 8.0.0-alpha7 Version 8.0.0-alpha8 Version 8.0.0-alpha9 Version 8.0.0-alpha10 Version 8.0.0-alpha11 Version 8.0.0-alpha12 Version 8.0.0-alpha13 Version 8.0.0-alpha14 Version 8.0.0-alpha15 Version 8.0.0-beta1 Version 8.0.0-beta2 Version 8.0.0-beta3 Version 8.0.0-beta4 Version 8.0.0-beta6 Version 8.0.0-beta7 Version 8.0.0-beta9 Version 8.0.0-beta10 Version 8.0.0-beta11 Version 8.0.0-beta12 Version 8.0.0-beta13 Version 8.0.0-beta14 Version 8.0.0-beta15 Version 8.0.0-beta16 Version 8.0.0-rc1 Version 8.0.0-rc2 Version 8.0.0-rc3 Version 8.0.0-rc4 Version 8.0.0 Version 8.0.1 Version 8.0.2 Version 8.0.3 Version 8.0.4 Version 8.0.5 Version 8.0.6 Version 8.1.0-beta1 Version 8.1.0-beta2 Version 8.1.0-rc1 Version 8.1.0 Version 8.1.1 Version 8.1.2 Version 8.1.3 Version 8.1.4 Version 8.1.5 Version 8.1.6 Version 8.1.7 Version 8.1.8 Version 8.1.9
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-7572 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-7572