CVE-2013-7067: The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an acce...

Security readout for executives and security teams

CVE-2013-7067 is an access-control bypass in the Drupal OG Features module. A remote requester could reach pages that were meant to be blocked when OG Features failed to preserve an access callback set to false. Business urgency depends on whether the module protects sensitive pages on an affected Drupal site. Exposure is likely limited to Drupal installations using OG Features 6.x-1.x before 6.x-1.4, especially where the module controls access to private Organic Groups-related pages. Treat as a targeted legacy web exposure issue. Prioritize if Drupal sites using OG Features store customer, member, or internal content behind page-level restrictions. Mitigation focus: Upgrade OG Features to 6.x-1.4 or later where the module is installed.; Review Drupal advisory guidance before applying compensating controls.; Audit restricted pages managed by OG Features for unintended anonymous access..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.