AIKIDO-2026-570477
drupal/restrict_route_by_ip is vulnerable to Access bypass
75
High Risk
This Affects:
drupal/restrict_route_by_ipTL;DR
The Restrict route by IP module limits which Drupal routes can be reached from configured IP addresses. During route rebuild, affected versions match restrictions against a previously stored route list and run before later route subscribers, so a subset of dynamic routes that are added or replaced during the rebuild never receive the IP restriction. An unauthenticated visitor can therefore open those routes from an address that should be blocked. Sites that do not restrict dynamic routes are not affected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and restrict dynamic routes by IP address.
Background info
drupal/restrict_route_by_ip is vulnerable to Access bypass in versions 0.0.1 - 1.3.0 and 2.0.0 - 2.0.0.
How to fix this
Upgrade the drupal/restrict_route_by_ip library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.