AIKIDO-2026-322210

TL;DR

The Quick Tabs module displays content in tabs by rendering blocks, nodes, views, or nested Quick Tabs instances. Affected versions do not correctly enforce access when rendering node and block tabs: a neutral access result is treated as a grant for node tabs and block plugins, and reusable custom blocks receive no access check. Content that should be denied — such as an unpublished node or unpublished reusable custom block — can therefore be shown to users without permission to view it. This is mitigated because affected content is selected by a user with the "administer quicktabs" permission when the tab is configured, so an attacker cannot choose which content is exposed.