Description
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 6.0, < 6.38 | 6.38 | GHSA-4gh5-3hqj-x3pj |
| Packagist | drupal/drupal | >= 6.0, < 6.38 | 6.38 | GHSA-4gh5-3hqj-x3pj |