CVE-2013-4498: The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete org...

Security readout for executives and security teams

This is an information exposure issue in an old Drupal contributed module. When Spaces OG content is moved between groups, some content may become orphaned instead of deleted. After an access rebuild, authenticated users with basic content access may be able to see sensitive group content they should not see. Exposure is limited to legacy Drupal 6 deployments using Spaces 6.x-3.x before 6.x-3.7 with the Spaces OG submodule and Organic Groups content workflows. Treat this as a targeted legacy-platform cleanup issue. It is not documented as actively exploited, but it can expose sensitive group content where old Drupal 6 collaboration sites still exist. Mitigation focus: Upgrade the Spaces module to 6.x-3.7 or later where applicable.; Check Drupal advisory guidance before changing legacy Drupal 6 systems.; Review and remove orphaned group space content containing sensitive information..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.