CVE-2022-25270

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

• CWE-863

• https://www.drupal.org/sa-core-2022-004Patch, Vendor Advisory
• https://www.drupal.org/sa-core-2022-004Patch, Vendor Advisory

Published

Feb 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25265In the Linux kernel through 5.16.10, certain binary files ma…7.8
• CVE-2022-25266Passwork On-Premise Edition before 4.6.13 allows migration/d…4.3
• CVE-2022-25267Passwork On-Premise Edition before 4.6.13 allows migration/u…8.8
• CVE-2022-25268Passwork On-Premise Edition before 4.6.13 allows CSRF via th…8.8
• CVE-2022-25269Passwork On-Premise Edition before 4.6.13 has multiple XSS i…6.1
• CVE-2022-2527An issue in Incident Timelines has been discovered in GitLab…8
• CVE-2022-25271Drupal core's form API has a vulnerability where certain con…7.5
• CVE-2022-25273Drupal core's form API has a vulnerability where certain con…7.5
• CVE-2022-25274Drupal 9.3 implemented a generic entity access API for entit…5.4
• CVE-2022-25275In some situations, the Image module does not correctly chec…7.5
• CVE-2022-25276The Media oEmbed iframe route does not properly validate the…6.1
• CVE-2022-25277Drupal core sanitizes filenames with dangerous extensions up…7.2