Drupal File Access Fix Incorrect Authorization Vulnerability Allowing Forceful Browsing

A vulnerability allowing access bypass has been identified in the Drupal File Access Fix (deprecated) module, affecting versions prior to 1.2.0. This issue arises because the module does not properly consider the results of hook_file_download when implemented by custom or contributed modules, leading to unauthorized access to files.

Impact

Exploitation of this vulnerability allows for forceful browsing, where users can bypass access controls to files, potentially leading to unauthorized file access.

Remediation

Users are advised to upgrade to File Access Fix version 8.x-1.2.