drupal/media_library_block - SA-CONTRIB-2023-003
The Media Library Block module allows you to render a media entity in a block.
The module does not properly check media access in some circumstances. This may result in unauthorized users (including anonymous users) seeing media items they are not authorized to access if a block containing a restricted media item is placed on the page.
Administrators may mitigate this vulnerability by removing blocks referencing media items that have access restrictions.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/media_library_block | < 1.0.4 | 1.0.4 |
| Drupal module | drupal/media_library_block | < 1.0.4 | 1.0.4 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/media_library_block- Disclosed
- 18.01.2023
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2023-003 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/media_library_block
All published vulnerabilities of this package (Drupal module), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.