This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. T...

The Smart Content Block submodule does not sufficiently check block access when rendering a Display Blocks reaction through its AJAX endpoint. This can let visitors see blocks restricted to other users if those blocks have been placed inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views checks access again when the view runs.

Look for drupal/smart_content and its version in composer.lock. The advisory lists 3.2.1 as fixed but gives no affected version range. Check whether your site uses the Smart Content Block submodule and has placed any block restricted to certain users inside a Display Blocks reaction. Sites using only Views blocks in reactions are not affected.

Use only Views blocks in reactions, as Views re-checks access when the view is executed.

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.

The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.

This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.