This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.
Impact
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.
Source excerpt · OSVThis vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.2.1Ecosystem versions | 3.2.1 |
Version evidence: OSV · DRUPAL-CONTRIB-2026-190
View original version evidence (0 explicit versions)
Original source description
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.
The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.
This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.