Actstream
Monthly
Incorrect authorization in the Drupal Actstream contributed module lets remote unauthenticated visitors reach protected activity-stream resources through forceful browsing, yielding limited reads and modifications of data they should not be able to touch (CVSS 6.5, C:L/I:L/A:N). Sites running Actstream in the affected ranges - 0.0.0 up to but not including 2.0.1, and 2.1.0 up to but not including 2.1.1 - are exposed only if this contributed module is installed and unpatched; Drupal core is not implicated. No public exploit code has been identified at the time of analysis, EPSS is 0.14% (4th percentile), and the issue is not in CISA KEV, so this is a moderate-severity, lower-priority item rather than an emergency.
Incorrect authorization in the Drupal Actstream contributed module lets remote unauthenticated visitors reach protected activity-stream resources through forceful browsing, yielding limited reads and modifications of data they should not be able to touch (CVSS 6.5, C:L/I:L/A:N). Sites running Actstream in the affected ranges - 0.0.0 up to but not including 2.0.1, and 2.1.0 up to but not including 2.1.1 - are exposed only if this contributed module is installed and unpatched; Drupal core is not implicated. No public exploit code has been identified at the time of analysis, EPSS is 0.14% (4th percentile), and the issue is not in CISA KEV, so this is a moderate-severity, lower-priority item rather than an emergency.