Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and (1) read unpublished content from anonymous users when a view is already configured to display the content, and (2) read private content in generated queries.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Views | Angrydonuts | 6.x-2.0 (including) | 6.x-2.0 (including) |
| Views | Angrydonuts | 6.x-2.0-alpha1 (including) | 6.x-2.0-alpha1 (including) |
| Views | Angrydonuts | 6.x-2.0-alpha2 (including) | 6.x-2.0-alpha2 (including) |
| Views | Angrydonuts | 6.x-2.0-alpha3 (including) | 6.x-2.0-alpha3 (including) |
| Views | Angrydonuts | 6.x-2.0-alpha4 (including) | 6.x-2.0-alpha4 (including) |
| Views | Angrydonuts | 6.x-2.0-alpha5 (including) | 6.x-2.0-alpha5 (including) |
| Views | Angrydonuts | 6.x-2.0-beta1 (including) | 6.x-2.0-beta1 (including) |
| Views | Angrydonuts | 6.x-2.0-beta2 (including) | 6.x-2.0-beta2 (including) |
| Views | Angrydonuts | 6.x-2.0-beta3 (including) | 6.x-2.0-beta3 (including) |
| Views | Angrydonuts | 6.x-2.0-beta4 (including) | 6.x-2.0-beta4 (including) |
| Views | Angrydonuts | 6.x-2.0-rc1 (including) | 6.x-2.0-rc1 (including) |
| Views | Angrydonuts | 6.x-2.0-rc2 (including) | 6.x-2.0-rc2 (including) |
| Views | Angrydonuts | 6.x-2.0-rc3 (including) | 6.x-2.0-rc3 (including) |
| Views | Angrydonuts | 6.x-2.0-rc4 (including) | 6.x-2.0-rc4 (including) |
| Views | Angrydonuts | 6.x-2.0-rc5 (including) | 6.x-2.0-rc5 (including) |
| Views | Angrydonuts | 6.x-2.1 (including) | 6.x-2.1 (including) |
| Views | Angrydonuts | 6.x-2.2 (including) | 6.x-2.2 (including) |
| Views | Angrydonuts | 6.x-2.3 (including) | 6.x-2.3 (including) |
| Views | Angrydonuts | 6.x-2.4 (including) | 6.x-2.4 (including) |
| Views | Angrydonuts | 6.x-2.5 (including) | 6.x-2.5 (including) |
| Views | Angrydonuts | 6.x-2.x-dev (including) | 6.x-2.x-dev (including) |