Drupal AJAX Dashboard Missing Authentication Vulnerability Allowing Access Bypass

A vulnerability in the Drupal AJAX Dashboard module, specifically in versions prior to 3.1.0, allows for access bypass due to inadequate authentication checks on the dashboard configuration route. This flaw enables unauthorized users to access the entity dashboard configuration page and manipulate dashboard visibility, although it does not permit direct editing of the dashboard configurations. The vulnerability requires the AJAX Dashboard: Entity Dashboards submodule to be enabled.

Impact

Exploitation of this vulnerability could lead to unauthorized access to dashboard configuration settings, allowing users to enable or disable entity dashboards without proper authorization.

Remediation

Users are advised to upgrade to AJAX Dashboard version 3.1.0 or later, which addresses this vulnerability.