CriticalGHSA-xq62-62c9-22mgCVE-2019-6342DRUPAL-CORE-2019-008

Drupal Improper Access Control

Published 11 Jan 2024 · Updated 10 Dec 2025

Affected package

Affected: >=8.7.4 <8.7.5
Fixed in: 8.7.5

Update to the fixed version for your release line, for example:composer require drupal/core:^8.7.5

Details

An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.

Is GHSA-xq62-62c9-22mg in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2019-6342
Linkgithub.com/drupal/core/commit/bac9bde22bb545ff72570d8a46055c6c6e70e7c5
Packagegithub.com/drupal/core
Linkwww.drupal.org/sa-core-2019-008

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.