AIKIDO-2025-10592
drupal/facets is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
69
Medium Risk
This Affects:
drupal/facetsTL;DR
Affected versions of this package are vulnerable to an Information Disclosure vulnerability. The module fails to properly check entity access permissions when displaying them as facet labels. This allows an attacker to see the names of restricted or unpublished entities (like private taxonomy terms) within the faceted search interface, which could reveal sensitive information about the site's structure or content that was intended to be private.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
drupal/facets is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 2.0.0 - 2.0.9 and 3.0.0 - 3.0.0.
How to fix this
Upgrade the drupal/facets library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant