This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the p...

Fasttoggle does not sufficiently protect its toggle URL against cross-site request forgery (CSRF). If a logged-in user with the "Use Fasttoggle" permission visits an attacker-controlled page, the attacker can change the publication status of arbitrary content on that user's behalf.

Look for drupal/fasttoggle and its version in composer.lock. The advisory lists 4.1.1 as fixed but gives no affected version range. Check which users have the Use Fasttoggle permission: the attack requires one of them to visit an attacker-controlled page while logged in.

The advisory notes that an attacker must trick a user with the "Use Fasttoggle" permission into visiting an attacker-controlled page while logged in.

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.

The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while logged in. This allows the attacker to change the publication status of arbitrary content on behalf of that user.

This vulnerability is mitigated by the fact that an attacker must trick a user with the permission "Use Fasttoggle" into visiting an attacker-controlled page.