CVE-2010-3093: Drupal

Low severity, CVSS 3.5. EPSS: 1.4% chance of exploitation in the next 30 days.

The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue.

Affected products

• Drupal Drupal: version 5.0 only; version 5.1 only; version 5.2 only; version 5.3 only; version 5.4 only; version 5.5 only; …

Published 2010-09-21. Last modified 2026-06-16.