Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.The configuration page admin/config/development/reroute_email access is restricted to users with administer reroute email permission, but this permission item is not marked as restrict access.
A user with the permission to access this page can set their own email address as the route-to email address, and use the password reset form to gain access to the password reset URLs of any user, making an account take over vulnerability.
It's not practical to filter out sensitive emails because that would beat the purpose of this email. Simply marking the permission as restrict access would be the idea fix in my opinion, for which I have attached a sample patch.
===
Originally reported by @Ayesh.
Comments
Comment #2
tokvv commentedAdded restricted access to reroute_email.permissions.yml.
Comment #3
abrammLooks good for me. RTBC.
Comment #5
bohartCommitted to 8.x.
Need to be ported to D7.
Comment #6
gilmordBackport of the patch for the D7
Comment #8
bohartCommitted to both 7.x-dev and 8.x-dev.
No need for test coverage.
Thanks, @all!