Project:
Date:
2020-February-19
Vulnerability:
Access Bypass
Affected versions:
1.0.0
Description:
The Profile module enables you to allow users to have configurable user profiles.
The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users.
Solution:
Install the latest version:
- If you use the Profile module for Drupal 8.x, upgrade to Profile 8.x-1.1
Also see the Profile project page.
Reported By:
Fixed By:
Coordinated By:
- Greg Knaddison of the Drupal Security Team
