This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance.
Impact
This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance.
Source excerpt · OSVThis vulnerability is slightly mitigated by the fact that an attacker must have a role with the permission "access content", so may not be accessible to anonymous users on all sites.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.0.5Ecosystem versions | 1.0.5 |
Version evidence: OSV · DRUPAL-CONTRIB-2022-051
View original version evidence (0 explicit versions)
Original source description
This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance.
The module doesn't sufficiently check access for the add operation. Users with permission to edit content can view and reference unpublished terms. The edit form may expose term data that users could not otherwise see, since there is no term view route by default.
This vulnerability is slightly mitigated by the fact that an attacker must have a role with the permission "access content", so may not be accessible to anonymous users on all sites.