—

DRUPAL-CORE-2019-008

Quick fix

DRUPAL-CORE-2019-008 — drupal/core: upgrade to the fixed version with the command below.

composer require drupal/core:^8.7.5

Details

In Drupal 8.7.4, when the [experimental](https://www.drupal.org/core/experimental#beta) Workspaces module is enabled, an access bypass condition is created.

This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.

Drupal 8.7.3 and earlier, Drupal 8.6.x and earlier, and Drupal 7.x are **not** affected.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/drupal/core

Introduced in: 8.7.4Fixed in: 8.7.5

Fixcomposer require drupal/core:^8.7.5

References

https://www.drupal.org/sa-core-2019-008[WEB]