I’ve discovered a potential access control issue in the entity_legal contributed module.
The view defined in the config file views.view.legal_document_acceptances.yml exposes a list of legal document acceptances, including the following fields:
Document Version name
User name (of the user who accepted the document)
Acceptance status
This view does not implement any permission-based access control, meaning any user with access to the view route — potentially including anonymous users, depending on how it is enabled
Add an access configuration to the view to limit visibility based on user role.
Active
4.1
Code
I was about RTBCing the MR, but I just noticed that the cache max age of the view was also changed from 0 (no caching) to -1 (cached permanently), so I'm leaving this to the maintainers; maybe they remember why they used 0 initially.