This module enables you to share users, content and configuration across a group of domains from a single Drupal installation.

The Drupal Domain Access module allows sharing of users, content, and configuration across multiple domains from a single installation. Its Domain Access submodule controls domain-specific content editing permissions. When the optional per-content-type grant setting is enabled, the module does not sufficiently verify which domains a user is assigned to, potentially allowing unauthorized content edits or deletions. Successful exploitation requires that the attacker holds a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" along with a per-content-type permission such as "Article: Edit any content on assigned domains", and that the attacker is assigned to at least one domain. The vulnerability is fixed in version 3.0.2.

An attacker with the necessary permissions and domain assignments could potentially edit or delete content on domains they should not have access to, violating content access controls. However, exploitation is limited by the requirement that the per-content-type grant setting be enabled (off by default) and the attacker must already have elevated permissions and domain assignments.

Upgrade the Drupal Domain Access module to version 3.0.2 or later where this vulnerability is fixed. If upgrading is not immediately possible, ensure the per-content-type grant setting remains disabled (default off) to mitigate the risk. Review user roles and permissions to limit assignment of the relevant content editing and deletion permissions to trusted users only.