Simple User Management
The module does not sufficiently check role delegation when approving users and offers an activate link for blocked administrators. An ordinary account on the site could view restricted user details and alter or add new user accounts.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a role with one of the module's additional action access rights.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Simple User Management to 8.x-1.11.
For developers: what the fix changed
The fix introduces a RoleDelegationAccess service in src/RoleDelegationAccess.php to centralise role delegation checks and protect user 1. It updates simple_user_management_entity_operation_alter in simple_user_management.module and the user management forms to use this service, ensuring proper access checks for approving, deactivating, and deleting users.
Also in this release The release also adds extensive test coverage and a test module.
simple_user_management.module+10 −16 fixsimple_user_management.permissions.yml+1 −1simple_user_management.services.yml+3 −0 fixsrc/Form/UserApprovalForm.php+36 −3 fixsrc/Form/UserChangePasswordForm.php+6 −8 fixsrc/Form/UserDeactivateForm.php+6 −15 fixsrc/Form/UserDeleteForm.php+9 −14 fixsrc/RoleDelegationAccess.php+63 −0 fix