DRUPAL-CORE-2020-008 BIT-drupal-2020-13667 CVE-2020-13667 GHSA-x2q9-r8gm-f657

Drupal Core Access bypass vulnerability

Medium Packagist

Severity: 5.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.93%; Chance of exploitation in the next 30 days. Higher than 60.56% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-276 Incorrect Default Permissions
Fix: Available; 2 packages have a fixed version

Description

The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace.

The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content.

This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module.

Affected versions

Packagist

Package	Vulnerable	Fixed in
drupal/core	`>= 8.0.0, < 8.8.10` `>= 8.9.0, < 8.9.6` `>= 9.0.0, < 9.0.6`	`8.8.10` `8.9.6` `9.0.6`
drupal/core	`>= 8.8.0, < 8.8.10`	`8.8.10`
drupal/core	`>= 8.9.0, < 8.9.6`	`8.9.6`
drupal/core	`>= 9.0.0, < 9.0.6`	`9.0.6`
drupal/drupal	`>= 8.8.0, < 8.8.10`	`8.8.10`
drupal/drupal	`>= 8.9.0, < 8.9.6`	`8.9.6`
drupal/drupal	`>= 9.0.0, < 9.0.6`	`9.0.6`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/core Packagist → `9.0.6`

composer

composer require drupal/core:^9.0.6

drupal/drupal Packagist → `8.8.10`

composer

composer require drupal/drupal:^8.8.10

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Weakness

CWE-276: Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

How to prevent it

Architecture and Design, Operation: The architecture needs to access and modification attributes for files to only those users who actually require those actions.
Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2020-13667

Packages

github.com/drupal/core

Timeline

Sep 16, 2020 Published
Sep 19, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
DRUPAL-CORE-2026-004 Drupal Core has a SQL Injection issue	Critical Known exploited	Also affects drupal/core
CVE-2020-28949 Multiple vulnerabilities through filename manipulation in Archive_Tar	High Known exploited	Also affects drupal/core
CVE-2020-13671 Drupal core Unrestricted Upload of File with Dangerous Type	High Known exploited	Also affects drupal/core
CVE-2019-6340 Drupal Core Remote Code Execution Vulnerability	High Known exploited	Also affects drupal/core
CVE-2018-7602 Drupal Core Remote Code Execution Vulnerability	Critical Known exploited	Also affects drupal/core
CVE-2018-7600 Drupal Core Remote Code Execution Vulnerability	Critical Known exploited	Also affects drupal/core
DRUPAL-CORE-2026-016 The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.	Not rated yet	Also affects drupal/core
DRUPAL-CORE-2026-015 The Drupal core Link module provides a field type that can be used for internal and external URLs.	Not rated yet	Also affects drupal/core

Credits: Andrei Mateescu

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor