drupal/acl - SA-CONTRIB-2023-034
The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes.
The module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection.
As this is an API module, it is only exploitable if a "client" module exposes the vulnerability. Details of some contributed client modules are given below. Custom modules using ACL could also expose the vulnerability.
This vulnerability is mitigated by the fact that an attacker typically needs an "admin"-type permission provided by one of ACL's client modules.
Known client modules include:
- Forum Access
- Flexi Access
- Content Access
Coordinated Security Advisories are being released for those client modules that have Security coverage.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/acl | < 1.0.0 | 1.0.0 |
| Drupal module | drupal/acl | < 1.0.0 | 1.0.0 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/acl- Disclosed
- 23.08.2023
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2023-034 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/acl
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.