View online: https://www.drupal.org/sa-contrib-2024-023 Project: Image Sizes [1] Date: 2024-May-29 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.0.2 Description:  This module enables you to create responsive image styles that depend on the parent element's width. The module doesn't sufficiently check access to rendered images, resulting in access bypass vulnerabilities in specific scenarios. Solution:  Install the latest version. * If you use the Image Sizes module for Drupal 10, upgrade to Image Sizes 3.0.2 [3] Reported By:  * Dezső Biczó [4] Fixed By:  * Dezső Biczó [5] * Pascal Crott [6] * Juraj Nemec [7] of the Drupal Security Team Coordinated By:  * Juraj Nemec [8] of the Drupal Security Team * Neil Drumm [9] of the Drupal Security Team [1] https://www.drupal.org/project/image_sizes [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/image_sizes/releases/3.0.2 [4] https://www.drupal.org/user/315522 [5] https://www.drupal.org/user/315522 [6] https://www.drupal.org/user/647364 [7] https://www.drupal.org/user/272316 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/3064