CVE-2022-25274: 
PHP vulnerability analysis and mitigation

Drupal 9.3 implemented a generic entity access API for entity revisions that contained a vulnerability (CVE-2022-25274) affecting sites using Drupal's revision system. The vulnerability resulted from incomplete integration with existing permissions, allowing possible access bypass for users who have access to use revisions of content generally, but lack access to individual items of node and media content (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. This indicates the vulnerability requires low privilege level, no user interaction, and can be exploited over the network, potentially leading to low-level impacts on confidentiality and integrity (NVD).

The vulnerability could allow users with general revision access permissions to bypass access controls and gain unauthorized access to node and media content that they should not have access to. This affects only sites that utilize Drupal's revision system (NVD).

The recommended mitigation is to upgrade Drupal installations to version 9.3.12 or later which contains the fix for this vulnerability. Users should avoid using versions >=9.3.0,<9.3.12 of the drupal/core package (FortiGuard).