The Simple OAuth module for Drupal introduces an OAuth 2.0 authorization server that can protect a Drupal instance with access tokens. A vulnerability exists because the module does not sufficiently restrict access to consumer configuration, allowing users with certain permissions to create or edit consumers that can obtain tokens with elevated privileges. This can lead to unauthorized access to the site as another user, including full administrative access. However, exploitation requires the attacker to already have roles with the Add consumer entities or Update own consumer entities permissions. Fixes are available in versions 5.2.6, 6.0.10, and 6.1.4.