This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to reques...

The module could reuse permissions cached for one user's OAuth2 token for another user's token with the same scopes, allowing a user to gain permissions they do not have, including administrative access. An attacker needs an OAuth2 token and cannot trigger the issue alone: a more privileged user's token with the same scopes must be used first. The issue was introduced in version 6.1.0 and is fixed in 6.1.3.

Check the version of drupal/simple_oauth in composer.lock: the issue was introduced in 6.1.0 and the fixed version is 6.1.3. Check whether OAuth2 tokens with the same scopes are used by users with different permissions, with a more privileged user's token used first. User 1 is not affected unless security.enable_super_user is set to false.

An attacker needs an OAuth2 token, and a more privileged user's token with the same scopes must be used first. User 1 is not affected unless security.enable_super_user is set to false.

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.

Since version 6.1.0, the module could cache a token's permissions in a way that let them be reused for another user's token with the same scopes. A user could gain permissions they do not have, including administrative access.

This vulnerability is mitigated by the fact that an attacker needs an OAuth2 token, and cannot trigger the issue themselves: a more privileged user's token with the same scopes must be used first. User 1 is not affected unless security.enable_super_user is set to false.