CVE-2009-4520: The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows rem...

Security readout for executives and security teams

This is an old Drupal module access-control flaw. Sites using vulnerable CCK Comment Reference versions could expose comments that should be restricted, because the autocomplete path did not enforce intended access rules. Exposure is likely limited to Drupal sites that installed the CCK Comment Reference contributed module in affected 5.x or 6.x versions. The bundle does not identify affected core Drupal versions, default configurations, or hosting environments. Treat as a privacy and information-disclosure issue for legacy Drupal estates. Prioritize if the affected module is internet-facing and stores sensitive internal, customer, or moderation comments. Mitigation focus: Upgrade CCK Comment Reference to 5.x-1.2 or 6.x-1.3, as applicable.; Review Drupal advisory guidance for any module-specific remediation notes.; Remove or disable the module if it is unused..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.