Servers and applications
CVE-2017-6930
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only…
- Severity
- High 8.1
- Published
- 1 Mar 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 8.4.5
- Exploit chance
- 1.3% in the next 30 daysHigher than 70% of CVEs. EPSS by FIRST, 11 Nov 2026
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Description
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().
Affected software
| Software | Affected versions |
|---|---|
DrupalServers and applications · cpe:a:drupal:drupal |
|