CVE-2016-7570

—

CVSS 3.0

4.3 medium

EPSS

2%p75

Published

Oct 3, 2016 (Oct 3, 2016)

Modified

Jun 17, 2026

Description

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

Vendors: drupal
Products: drupal
Ecosystems: Drupal
Weakness: CWE-264
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.