A security issue has been reported in Drupal, which can lead to unauthorised users performing actions with escalated privileges.

The security is caused due to the "Content Construction Kit" (CCK) and various CCK field modules extending the "administer content types" permission. This results in the "administer content types" permission being comparable to the "administer site configuration" permission.

This security issue is reported in versions 5.x and 6.x.

Solution
Grant the "administer content types" permission to trusted users only.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
SA-CORE-2009-002:
http://drupal.org/node/372836

Deep Links
Links available in Customer Area