Freelinking
Monthly
Server-side request forgery in the Drupal Freelinking contrib module allows an authenticated user with permission to create or edit content - and only when the Freelinking filter is enabled on an active text format - to make the Drupal site issue attacker-influenced outbound requests, with partial confidentiality impact and no integrity or availability effect. All releases from 0.0.0 through 4.0.3 are in scope, and the vendor has published a security advisory with a fix. Risk signals are consistently low: EPSS 0.14% (4th percentile), SSVC exploitation none and automatable no, and no public exploit identified at time of analysis, so this fits a this_month remediation cadence rather than emergency response.
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.0.0 before 4.0.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for (1) nodes or (2) users, which allows remote attackers to obtain. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Server-side request forgery in the Drupal Freelinking contrib module allows an authenticated user with permission to create or edit content - and only when the Freelinking filter is enabled on an active text format - to make the Drupal site issue attacker-influenced outbound requests, with partial confidentiality impact and no integrity or availability effect. All releases from 0.0.0 through 4.0.3 are in scope, and the vendor has published a security advisory with a fix. Risk signals are consistently low: EPSS 0.14% (4th percentile), SSVC exploitation none and automatable no, and no public exploit identified at time of analysis, so this fits a this_month remediation cadence rather than emergency response.
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.0.0 before 4.0.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for (1) nodes or (2) users, which allows remote attackers to obtain. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.