The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Restricted admins always need the system.module permission "access administration pages" in order to get their admin pages in their navigation menu. It seems this module grants access to it's administration pages solely on the basis of this permission?! So basically anyone who administers some module gets to administer this one.
Right now I don't have the time to look into the code, but I wanted to report this quickly...
Comments
Comment #1
drummPublishing since this was handled by the Drupal security team removing support for this project. The successor module mentioned on the project page, https://www.drupal.org/project/sso, does not have this issue.