Executive brief
Drupal Diff is a module that allows authorized users to view and compare changes between entity revisions. The module fails to properly enforce access controls on non-node entity revision diffs, allowing users with basic entity view permissions to access revision comparisons they should not be able to see. This could expose sensitive draft content or revision history to unauthorized users.
Technical details
This is an access control bypass vulnerability affecting how Drupal Diff enforces permissions on entity revision diff viewing. The module insufficiently restricts access to non-node entity revision diffs, meaning authorization checks do not properly validate user permissions before displaying comparative diff information. The vulnerability requires an attacker to already possess a role with permissions to view the target entity type—they cannot access revisions for entity types they have no permission to view. Patches are available in versions 2.0.1 and 2.1.1.
Affected products
- Drupal Diff before 2.0.1, and 2.1.0 before 2.1.1
Timeline
- 2026-08-12: disclosed
- 2026-08-11: patched: Versions 2.0.1 and 2.1.1 released with fix