CVE-2015-4389: The Open Graph Importer (og_tag_importer) 7.x-1.x for Drupal does not properly check the create permission...

Security readout for executives and security teams

A Drupal 7 Open Graph Importer module permission flaw could let logged-in users with import rights create content types they were not meant to create. This is an authorization bypass, not evidence of full system compromise. Business urgency depends on whether the module is installed and who has the import permission. Exposure is likely limited to Drupal 7 sites using og_tag_importer 7.x-1.x where authenticated users have the import permission. Sites without the module, without Drupal 7, or without delegated import access are not indicated as exposed by the supplied sources. Prioritize assessment if Drupal 7 editorial or partner users can import Open Graph content. Treat this as a contained access-control issue unless local evidence shows misuse or broader privileged access. Mitigation focus: Inventory Drupal sites for og_tag_importer 7.x-1.x.; Review roles granted the "import og_tag_importer" permission.; Remove that permission from users who do not strictly need it..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.