Panels enables administrators to add page variants within page manager, panelizer, etc to create custom pages.
Impact
Panels enables administrators to add page variants within page manager, panelizer, etc to create custom pages.
Source excerpt · OSVThis vulnerability is mitigated by the fact that an attacker must know the machine name of the variant and underlying page, which is not available within the source code of a page.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 4.9.0Ecosystem versions | 4.9.0 |
Version evidence: OSV · DRUPAL-CONTRIB-2025-033
View original version evidence (0 explicit versions)
Original source description
Panels enables administrators to add page variants within page manager, panelizer, etc to create custom pages.
The module doesn't sufficiently protect sensitive routes, allowing an attacker to view and modify blocks within variants without requiring appropriate permission.
This vulnerability is mitigated by the fact that an attacker must know the machine name of the variant and underlying page, which is not available within the source code of a page. Additionally, only simple blocks can be added or edited, as a more complex block will trigger an error due to missing permissions.