{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-18259","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-18259\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-18259\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/2495327","id":"2495327","resource":"node"},"field_sa_advisory_id":"090","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/bramdriesen\u0022 rel=\u0022nofollow\u0022\u003EBram Driesen (bramdriesen)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/cilefen\u0022 rel=\u0022nofollow\u0022\u003Ecilefen  (cilefen)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/akalata\u0022 rel=\u0022nofollow\u0022\u003ESwan Kalata (akalata)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Complex\/A:None\/CI:Some\/II:None\/E:Theoretical\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EThe Token Content Access module enables site administrators to provide access to content using access tokens.\u003C\/p\u003E\n\u003Cp\u003EThe module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access restrictions for content protected by this module.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that an attacker must know or discover a URL for content protected by Token Content Access, and exploiting the issue requires measuring timing differences in token comparison responses.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/lobodakyrylo\u0022 rel=\u0022nofollow\u0022\u003EKyrylo Loboda (lobodakyrylo)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/robincs\u0022 rel=\u0022nofollow\u0022\u003ERobin  (robincs)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E If you use the Token Content Access module for Drupal 10.x\/11.x, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/tca\/releases\/3.1.2\u0022 rel=\u0022nofollow\u0022\u003EToken Content Access 3.1.2\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Access bypass","field_issue_last_status_change":"1785344913","field_sa_cve":["CVE-2026-18259"],"field_is_psa":"0","field_affected_versions":"\u003C3.1.2","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3613787","id":"3613787","resource":"node"}],"nid":"3611483","vid":"14446674","is_new":false,"type":"sa","title":"Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-090","edit_url":"https:\/\/www.drupal.org\/node\/3611483\/edit","status":"1","promote":"0","sticky":"0","created":"1785344913","changed":"1785344913","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16711860","id":16711860,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16711861","id":16711861,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16711862","id":16711862,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16711863","id":16711863,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16711864","id":16711864,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16711865","id":16711865,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16711874","id":16711874,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1785344913"}]}