What’s Vulnerable › Vulnerabilities
CVE-2020-13668: Access bypass in Drupal Core 8/9
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-02-11 · updated 2026-06-17
- Weakness: CWE-79
Description
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Affected products
- Drupal: from 8.8.0 before 8.8.10; from 8.9.0 before 8.9.6; from 9.0.0 before 9.0.6 — fixed in 8.8.10, 8.9.6, 9.0.6
How to fix
Upgrade to a fixed version: Drupal 8.8.10, 8.9.6, 9.0.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2020-13668 or the next vulnerability affects your stack