Drupal Canvas Incorrect Authorization Vulnerability Allowing Forceful Browsing

A vulnerability in the Drupal Canvas module, versions prior to 1.0.4, allows for incorrect authorization and forceful browsing. The issue arises because the module does not properly validate access to unpublished Canvas Pages. While this vulnerability is somewhat mitigated by the default content moderation settings and the lack of an archiving feature, it still presents a risk by enabling unauthorized access to certain pages.

Impact

Exploitation of this vulnerability could lead to unauthorized access to unpublished Canvas Pages, allowing users to view or interact with content that should not be publicly accessible.

Remediation

Users of the Drupal Canvas module should upgrade to version 1.0.4.