Executive brief
Drupal's Smart Content module personalizes web content by showing different blocks to visitors based on conditions. A flaw in the Smart Content Block submodule fails to properly verify access permissions when rendering blocks through an AJAX endpoint, potentially allowing users to view blocks they should not have access to. The risk is limited to sites that have placed access-restricted blocks (other than Views blocks) within Display Blocks reactions.
Technical details
The Smart Content Block submodule lacks sufficient access control checks when rendering blocks in a "Display Blocks" reaction via the module's AJAX endpoint. An attacker with network access can invoke the AJAX endpoint to retrieve blocks whose access is normally restricted to specific users. Views blocks are not vulnerable because Views re-checks access during execution; the issue affects only non-Views blocks with custom access restrictions.
Affected products
- Drupal Smart Content before 3.2.1
Timeline
- 2026-09-23: disclosed