Skip to content
OpenAdvisories
Unscored DRUPAL-CORE-2020-006

JSON:API PATCH requests may bypass validation for certain fields. By default, JSON:API works in a read-only mode which makes it impossible …

Published Jun 17, 2020 · Updated Sep 19, 2026 · Assigned by DRUPAL

Package: drupal/core Ecosystem: Packagist

Description

JSON:API PATCH requests may bypass validation for certain fields.

By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the `read_only` set to `FALSE` under `jsonapi.settings` config are vulnerable.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/core >= 8.0.0, < 8.8.8 · >= 8.9.0, < 8.9.1 · >= 9.0.0, < 9.0.1 8.8.8, 8.9.1, 9.0.1 DRUPAL-CORE-2020-006

References