This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types...

A user can create media items of a type they do not have permission to create if the bulk upload form is configured for that type. The attacker must have a role with the bulk upload form permission.

Look for drupal/media_bulk_upload and its version in composer.lock. Version 3.0.6 is fixed; the advisory does not give an affected version range. Check which media types the bulk upload form is configured for, and whether roles with bulk upload form permission lack permission to create those types.

The advisory identifies the requirement for a role with the bulk upload form permission as a mitigating factor.

This module enables users to upload files and create media items in bulk.

The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "bulk upload form".