—

DRUPAL-CONTRIB-2020-004

Details

The Profile module enables you to allow users to have configurable user profiles.

The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/profile

Introduced in: 1.0.0

No fixed version published yet for drupal/profile. Pin to a known-safe version or switch to an alternative.

References

https://www.drupal.org/sa-contrib-2020-004[WEB]