| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/block_permissions | ≥ 1.0.0, < 1.2.0 | 1.2.0 |
| block permissions | ≥ 1.0.0, < 1.2.0 | 1.2.0 |
This module enables you to manage blocks from specific modules in the specific themes.
The module doesn't sufficiently check permissions under the scenario when a block is added using the form "/admin/structure/block/add/{plugin_id}/{theme}" (route "block.admin_add"). The attacker can add the block to the theme where they can't manage blocks.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks provided by [provider]".
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free