CVE-2020-13677: 
PHP vulnerability analysis and mitigation

The vulnerability CVE-2020-13677 affects the Drupal core JSON:API module. Under specific circumstances, this vulnerability allows improper access control, potentially resulting in unintended access bypass. The vulnerability was initially recorded on May 28, 2020, and only affects sites that have the JSON:API module enabled (CVE Mitre).

The vulnerability has been assigned a CVSS 3 Severity Score of 7.5 (High), indicating significant security implications (Ubuntu Security). The issue specifically relates to improper access control mechanisms within the JSON:API module of Drupal core, which could lead to unauthorized access to certain content.

When exploited, this vulnerability can result in unauthorized access to content that should be restricted, potentially compromising the confidentiality of data stored within Drupal installations (CERT-FR).

The vulnerability affects Drupal core versions 9.2.x before 9.2.6, 9.1.x before 9.1.13, and 8.9.x before 8.9.19. Users running versions prior to 8.9.x and 9.1.x, which are no longer maintained, must first update their Drupal installation to a supported version to receive security fixes (CERT-FR).