CVE-2013-2123: The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does no...

Security readout for executives and security teams

A Drupal contributed module could let a remote user modify content they should not control. The issue appears when Node access user reference is used with author update/delete grants, content has a user reference field, and the author account is deleted. This is primarily a content integrity and governance risk. Exposure is limited to Drupal sites using the Node access user reference contributed module in the affected 6.x-3.x or 7.x-3.x branches, with the specific grant and content conditions described. Sites not using this module or configuration are not indicated as affected in the provided sources. Prioritize remediation for internet-facing Drupal sites where content integrity, approvals, or regulated communications matter. The issue is old and conditional, but affected legacy sites may remain exposed if contributed modules were not maintained. Mitigation focus: Upgrade Node access user reference to 6.x-3.5 or 7.x-3.10 or later, as applicable.; If upgrade is not immediate, review vendor advisories and restrict risky content workflows.; Audit author update/delete grant settings and content using user reference fields..

Prepared

Jun 14, 2026, 17:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.