Drupal Advanced Search access control bypass can expose restricted block content

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

• The Drupal advanced_search module is affected from 0.0.0 through versions less than 2.4.5.
• Drupal's advisory directs Advanced Search users to upgrade to 2.4.5.
• The available evidence does not establish the status of parallel branches or releases outside the stated range.

Drupal Advanced Search provides AJAX updates for advanced search, facet, and search result blocks. Its publicly accessible AJAX endpoint permits arbitrary block IDs to be submitted, but the module does not sufficiently check block access before returning content. An unauthenticated attacker may retrieve content from a restricted block if the attacker knows or guesses that block's machine ID. The documented precondition is that the block must contain sensitive content protected by block access or visibility restrictions. The confirmed weakness is CWE-862, Missing Authorization. The available evidence does not identify the exact endpoint parameter names or the implementation details of the fix.

The affected functionality is reachable over the network through a publicly accessible endpoint. The supplied attack characteristics indicate that no privileges are required, attack complexity is high, and user interaction is required; the advisory does not explain what interaction is required. Drupal documents a practical precondition of knowing or guessing a restricted block's machine ID, together with the block containing sensitive content protected by access or visibility restrictions. The normalized record does not list a public exploit and leaves known exploitation status unspecified; this does not prove that no exploit or abuse exists.

The direct technical outcome is unauthorized reading of block content that access or visibility restrictions were intended to protect. Scope remains unchanged, and the supplied impact characterization identifies low confidentiality impact with no availability impact. The record also carries low integrity impact, but the advisory does not describe a modification operation, so any integrity consequence remains uncertain. The available evidence does not establish code execution, account takeover, or broader compromise of Drupal.

The flaw may expose content intended only for authenticated users or users who satisfy visibility restrictions. The level of exposure depends on whether restricted blocks contain sensitive information. Organizations may need to upgrade the module and review sensitive block configurations, but the available evidence does not establish that data was accessed or that a specific deployment was compromised. The supplied record does not identify an availability impact.

1. Upgrade Advanced Search to 2.4.5, the exact release named as the solution in Drupal's advisory.
2. Recheck the complete deployment inventory to confirm that no affected release remains, then test the module's AJAX search, facet, and result block behavior.
3. If the upgrade cannot be completed immediately, treat deployments in the affected range as exposed and perform a documented review of sensitive blocks and endpoint exposure. The available evidence does not provide a separate vendor-confirmed mitigation, so this review should not be treated as a fix.

1. Inventory sites using the Advanced Search module and compare installed releases with the affected and fixed boundaries documented in the advisory.
2. Identify configured advanced search, facet, and search result blocks that use the module's public AJAX functionality.
3. Review the access rules, visibility restrictions, and sensitivity of content rendered by those blocks.
4. As a precaution, review web and application logs for unauthenticated requests to the module's AJAX endpoint, especially requests containing block identifiers. The available evidence does not define a confirmed IOC or exact log signature, and the absence of matching logs does not prove safety.