Skip to content
OpenAdvisories
Unscored DRUPAL-CONTRIB-2023-003

The Media Library Block module allows you to render a media entity in a block. The module does not properly check media access in some circ…

Published Jan 18, 2023 · Updated Sep 10, 2026 · Assigned by DRUPAL

Description

The Media Library Block module allows you to render a media entity in a block.

The module does not properly check media access in some circumstances. This may result in unauthorized users (including anonymous users) seeing media items they are not authorized to access if a block containing a restricted media item is placed on the page.

Administrators may mitigate this vulnerability by removing blocks referencing media items that have access restrictions.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/media_library_block < 1.0.4 1.0.4 DRUPAL-CONTRIB-2023-003

References