Threats tagged 'drupal-contrib-2026-306'

The Drupal Scheduler module has a vulnerability where it does not properly verify user permissions when changing publication or unpublication dates. This can lead to content being published earlier or unpublished later than intended. The issue requires the attacker to already have edit permissions on the content and the content must be editable via web services APIs such as JSON:API or REST. Fixed versions are available.