Executive brief
The Quick Tabs module for Drupal creates tabbed content blocks on websites, including nodes and reusable custom blocks. The module failed to properly enforce access controls, allowing unpublished or restricted content to be displayed to users who should not have permission to view it. An attacker with the ability to configure Quick Tabs blocks could expose sensitive unpublished content to unauthorized users.
Technical details
The vulnerability is an access control bypass (CWE-284) in the Quick Tabs module's node and block tab rendering logic. The module incorrectly treated neutral access results as grants for node tabs and performed no access checks for reusable custom blocks, allowing protected or unpublished content to be rendered. The attack vector is local/network depending on whether the attacker has administrative configuration access, and exploitation requires the "administer quicktabs" permission to select which content is exposed. An attacker cannot directly choose arbitrary content to expose but can select from available content during tab configuration. The vulnerability is fixed in version 4.3.1.
Affected products
- Drupal Quick Tabs before 4.3.1
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Version 4.3.1 released