Drupal Layout Builder Advanced Permissions Missing Authorization Vulnerability Allowing Forceful Browsing

A missing authorization vulnerability has been identified in the Drupal Layout Builder Advanced Permissions module, specifically in versions prior to 2.2.0. This vulnerability allows for access bypass, enabling forceful browsing. The issue arises because the module does not adequately control access for adding sections in the submodule, potentially allowing users to manipulate layouts beyond their intended permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized access and manipulation of layout permissions, allowing users to bypass restrictions and modify content layouts they should not have access to.

Remediation

Users of the Layout Builder Advanced Permissions module should upgrade to version 2.2.1.