Security advisories for contributed projects

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Drupal Security Team — Wed, 07 Oct 2026 16:58:12 +0000

Project:

Advanced Filesystem

Project machine name:

advanced_filesystem

Date:

2026-October-07

Security risk:

Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default

Vulnerability:

Cross-Site Request Forgery

Affected versions:

<1.0.28

CVE IDs:

CVE-2026-107262

Description:

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem.

The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

The vulnerability is mitigated by the fact that advanced_filesystem_backup module must be enabled.

Solution:

Install the latest version:

If you use the Advanced File System module, upgrade to Advanced File System 1.0.28

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Cristiano Demari (cristianodemari)

Coordinated By:

Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216

Drupal Security Team — Wed, 07 Oct 2026 16:55:41 +0000

Project:

Restrict route by IP

Project machine name:

restrict_route_by_ip

Date:

2026-October-07

Security risk:

Critical 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default

Vulnerability:

Access bypass

Affected versions:

<1.3.1 || >=2.0.0 <2.0.1

CVE IDs:

CVE-2026-107255

Description:

This module enables you to restrict access to routes by IP address.

The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic.

Solution:

Install the latest version:

If you use the Restrict route by IP 2.0.x, upgrade to Restrict route by IP 2.0.1
If you use the Restrict route by IP 1.3.x, upgrade to Restrict route by IP 1.3.1

Reported By:

Elia Wehbe (ewehbe)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

Drupal Security Team — Wed, 07 Oct 2026 16:39:53 +0000

Project:

Examples for Developers

Project machine name:

examples

Date:

2026-October-07

Security risk:

Less critical 8 ∕ 25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All

Vulnerability:

Allocation of resources without limits or throttling

Affected versions:

<4.0.7

CVE IDs:

CVE-2026-107312

Description:

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.

The "Email Example" feature implemented by the email_example submodule can be used to send illegitimate emails to arbitrary email addresses.

Therefore, the email_example sub-module is being removed from Examples for Developers until a version demonstrating security best practices can be added back in the future. Developers who based a new module on this example should review their code.

Solution:

Any site with the email_example submodule installed should uninstall it immediately. Then, install the latest version of Examples for Developers:

If you are using Examples for Developers 4.0.x, upgrade to Examples for Developers 4.0.7.

Developers who based a new module or custom code on this example should review their code.

Reported By:

Alberto Paderno (avpaderno)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

Drupal Security Team — Wed, 07 Oct 2026 16:39:13 +0000

Project:

Permissions by Term

Project machine name:

permissions_by_term

Date:

2026-October-07

Security risk:

Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon

Vulnerability:

Information disclosure

Affected versions:

<3.1.41

CVE IDs:

CVE-2026-107311

Description:

This module enables you to restrict view access to single nodes via taxonomy terms.

The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API.

This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.

Solution:

Install the latest version:

If you use the Permissions by Term module, upgrade to Permissions by Term 3.1.41

Reported By:

ayrmax

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Damien McKenna (damienmckenna) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Pierre Rudloff (prudloff) of the Drupal Security Team

Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

Drupal Security Team — Wed, 07 Oct 2026 16:38:21 +0000

Project:

Freelinking

Project machine name:

freelinking

Date:

2026-October-07

Security risk:

Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default

Vulnerability:

Information Disclosure

Affected versions:

<4.0.3

CVE IDs:

CVE-2026-107310

Description:

This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content.

The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs.

This vulnerability is mitigated by the fact that an attacker must have access to use a text format with the Freelinking plugin configured to allow privately-accessible external URLs to be crawled. Site administrators may want to disable this functionality to evaluate any risk.

Solution:

Install the latest version:

If you use the Freelinking module, upgrade to Freelinking 4.0.3

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

Drupal Security Team — Wed, 07 Oct 2026 16:37:06 +0000

Project:

Easy Breadcrumb

Project machine name:

easy_breadcrumb

Date:

2026-October-07

Security risk:

Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon

Vulnerability:

Information disclosure

Affected versions:

<2.0.11

CVE IDs:

CVE-2026-107309

Description:

This module enables you to show a breadcrumb trail for taxonomy term hierarchies.

The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment.

This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (term_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished.

Solution:

Install the latest version:

If you use the Easy Breadcrumb module, upgrade to Easy Breadcrumb 2.0.11

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Brooke Mahoney (loopduplicate)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Drupal Security Team — Wed, 07 Oct 2026 16:36:17 +0000

Project:

Country

Project machine name:

country

Date:

2026-October-07

Security risk:

Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon

Vulnerability:

Cross-site scripting

Affected versions:

<2.1.3 || >=2.2.0 <2.2.1

CVE IDs:

CVE-2026-107308

Description:

The module Country provides a dedicated field type for Drupal core's official country list.

The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability.

This vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required.

Solution:

Install the latest version:

If you use the Country module 2.2.x, upgrade to Country 2.2.1.
If you use the Country module 2.1.x, upgrade to Country 2.1.3.

Reported By:

Conrad Lara (cmlara)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Damien McKenna (damienmckenna) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

Drupal Security Team — Wed, 07 Oct 2026 16:35:32 +0000

Project:

SmartLinker AI

Project machine name:

smartlinker_ai

Date:

2026-October-07

Security risk:

Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All

Vulnerability:

Information disclosure

Affected versions:

<1.0.3

CVE IDs:

CVE-2026-107307

Description:

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to.

The module's search query did not respect entity access when returning results to the browser.

This vulnerability is mitigated by the fact that an user must have permission to use the AI CKEditor "Generate internal links" feature on a text format.

Solution:

Install the latest version:

Upgrade to SmartLinker AI 1.0.3.

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Drupal Security Team — Wed, 07 Oct 2026 16:34:32 +0000

Project:

Menu Link Attributes

Project machine name:

menu_link_attributes

Date:

2026-October-07

Security risk:

Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon

Vulnerability:

Cross-site scripting

Affected versions:

<1.8.0

CVE IDs:

CVE-2026-107306

Description:

This module enables you to add HTML attributes to menu links and their container elements (<li>).

The module doesn't sufficiently sanitize the attributes it applies to menu link container elements.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "Administer menus and menu links" and "Use menu link attributes". In addition, an unsafe container attribute must already be configured by a user with the restricted permission "Administer menu link attributes". The default configuration is not affected.

Solution:

Install the latest version:

If you use the Menu Link Attributes module for Drupal 8.x or later, update to Menu Link Attributes 8.x-1.8.

After updating, run the database updates. The update removes any unsafe attribute definitions from the module's configuration and clears the render cache, so previously rendered menus no longer contain unsafe attributes.

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Drupal Security Team — Wed, 07 Oct 2026 16:33:07 +0000

Project:

DKAN

Project machine name:

dkan

Date:

2026-October-07

Security risk:

Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon

Vulnerability:

Access bypass

Affected versions:

<4.0.4 || >=4.1.0 <4.1.5

CVE IDs:

CVE-2026-107267

Description:

The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API.

The module does not correctly check access for all of its endpoints, leading to a potential access bypass.

The vulnerability is mitigated by the fact that it is only impactful for sites that do not give "access content" permission to the anonymous role.

Solution:

Install the latest version:

If you use DKAN 4.1.x, upgrade to DKAN 4.1.5
If you use DKAN 4.0.x, upgrade to DKAN 4.0.4

Reported By:

Rodel Duterte (rduterte)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Drupal Security Team — Wed, 07 Oct 2026 16:32:37 +0000

Project:

Two Factor Authentication - TFA / Passwordless Login

Project machine name:

miniorange_2fa

Date:

2026-October-07

Security risk:

Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default

Vulnerability:

Information disclosure

Affected versions:

<5.4.1 || >=5.5.0 <5.5.2

CVE IDs:

CVE-2026-107268

Description:

This module enables you to add an extra layer of verification for user login flow.

The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated users.

The vulnerability is mitigated by the fact that Headless 2FA must be turned on by a user with a miniorange 2fa headless permission, which is a restricted permission.

Solution:

Install the latest version:

If you use the 5.5.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.5.2
If you use the 5.4.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.4.1

Reported By:

Nam Nguyen Le Thanh (yuwkaa)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Drupal Security Team — Wed, 07 Oct 2026 16:30:05 +0000

Project:

Xray Audit

Project machine name:

xray_audit

Date:

2026-October-07

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<1.6.3 || >=2.0.0 <2.0.4 || >=3.0.0 <3.1.1

CVE IDs:

CVE-2026-96389

Description:

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration.

The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content.

This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed.

Solution:

Install the latest versions:

If you use the X-ray Audit version 3.1.x, upgrade to X-ray Audit 3.1.1.
If you use the X-ray Audit version 2.0.x, upgrade to X-ray Audit 2.0.4.
If you use the X-ray Audit version 1.6.x, upgrade to X-ray Audit 1.6.3.

Reported By:

eduardo morales alberti
Hemant Gupta (guptahemant)
Marcus Johansson (marcus_johansson)
Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

Luis Ruiz Peidró (lpeidro)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

Drupal Security Team — Wed, 07 Oct 2026 16:29:40 +0000

Project:

Views Share

Project machine name:

views_share

Date:

2026-October-07

Security risk:

Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<2.0.1

CVE IDs:

CVE-2026-107266

Description:

This module enables you to "share" a view display within another website via an iframe.

The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance.

This vulnerability is mitigated by the fact that an attacker must know the view and display IDs.

Solution:

Install the latest version:

If you use the Views Share module, upgrade to Views Share 2.0.1

Reported By:

Hemant Gupta (guptahemant)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Drupal Security Team — Wed, 07 Oct 2026 16:28:49 +0000

Project:

Leaflet

Project machine name:

leaflet

Date:

2026-October-07

Security risk:

Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Cross site scripting

Affected versions:

<10.4.13

CVE IDs:

CVE-2026-107265

Description:

The Leaflet module provides integration with the Leaflet JS mapping library.

Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability.

This vulnerability is mitigated by the fact an attacker needs to have permission to create or edit content that is used in a Leaflet map.

Solution:

Install the latest version:

If you use the Leaflet module, upgrade to release 10.4.13

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Italo Mairo (itamair)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

Drupal Security Team — Wed, 07 Oct 2026 16:27:03 +0000

Project:

Inline Formatter Field

Project machine name:

inline_formatter_field

Date:

2026-October-07

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default

Vulnerability:

Server-side template injection

Affected versions:

<4.2.0

CVE IDs:

CVE-2026-107264

Description:

The Inline Formatter Field module allows site builders to template and style entities with a field.

This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.

Solution:

Install the latest version:

If you use the Inline Formatter Field module, upgrade to Inline Formatter Field 4.2.0

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Bobby Saul (bobbysaul)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

Drupal Security Team — Wed, 07 Oct 2026 16:26:15 +0000

Project:

Gutenberg

Project machine name:

gutenberg

Date:

2026-October-07

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default

Vulnerability:

Access bypass

Affected versions:

<2.15.0 || >=3.0.0 <3.0.7

CVE IDs:

CVE-2026-107263

Description:

This module provides a new UI experience for node editing using the Gutenberg Editor library.

The module does not sufficiently check entity access in several editor endpoints.

This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission.

Solution:

Install the latest version:

If you use the Gutenberg module versions 3.0.x, upgrade to Gutenberg 3.0.7
If you use the Gutenberg module versions 8.x-2.x, upgrade to Gutenberg 8.x-2.15

Reported By:

Tommaso Gregori (p1s1o)
Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

Stephan Zeidler (szeidler)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Drupal Security Team — Wed, 07 Oct 2026 16:23:53 +0000

Project:

Authenticator Login Plus (2FA)

Project machine name:

auth_login_plus

Date:

2026-October-07

Security risk:

Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Improper authentication

Affected versions:

<1.0.1

CVE IDs:

CVE-2026-107261

Description:

This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide.

The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.

Solution:

Install the latest version:

If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1.

After upgrading, users who previously disabled 2FA will be asked to set it up again at their next login. Administrators can also re-enable 2FA for a user from the admin overview so the user keeps their existing authenticator.

Reported By:

mouhamed rayen mansouri (w0nd3r)

Fixed By:

mugesh.s

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

Drupal Security Team — Wed, 07 Oct 2026 16:23:38 +0000

Project:

Linked Field

Project machine name:

linked_field

Date:

2026-October-07

Security risk:

Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Server-side template injection

Affected versions:

<1.8.0

CVE IDs:

CVE-2026-107259

Description:

This module enables you to link the output of a field to a URL or to the value of another field.

The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site configuration values, which may include sensitive information such as API keys or credentials.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content in a field that has Linked Field enabled in its display settings.

Solution:

Install the latest version:

If you use the Linked Field module for Drupal 8.x or later, update to Linked Field 8.x-1.8

Reported By:

Maksim Hayder (tr_jan)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Drupal Security Team — Wed, 07 Oct 2026 16:22:57 +0000

Project:

Inline Entity Form Dialog

Project machine name:

inline_entity_form_dialog

Date:

2026-October-07

Security risk:

Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<1.0.6

CVE IDs:

CVE-2026-107258

Description:

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields.

This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".

Solution:

Install the latest version:

If you use the Inline Entity Form Dialog module for Drupal 11, upgrade to Inline Entity Form Dialog 1.0.6

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

Drupal Security Team — Wed, 07 Oct 2026 16:22:05 +0000

Project:

Actstream

Project machine name:

actstream

Date:

2026-October-07

Security risk:

Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<2.0.1 || >=2.1.0 <2.1.1

CVE IDs:

CVE-2026-107257

Description:

Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities.

The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability.

Solution:

Install the latest version:

If you use Actstream 2.1.x, upgrade to Actstream 2.1.1.
If you use Actstream 2.0.x, upgrade to Actstream 2.0.1.

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Reva Gomes (revagomes)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

Drupal Security Team — Wed, 07 Oct 2026 16:21:13 +0000

Project:

Authenticator Login Plus (2FA)

Project machine name:

auth_login_plus

Date:

2026-October-07

Security risk:

Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Improper authentication

Affected versions:

<1.0.1

CVE IDs:

CVE-2026-107254

Description:

This module provides TOTP-based two-factor authentication (2FA) for Drupal.

The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link.

This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a victim's account.

Solution:

Install the latest version:

If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1.

After upgrading, users with 2FA enabled will be asked for their verification code after using a one-time login link.

Reported By:

mouhamed rayen mansouri (w0nd3r)

Fixed By:

mugesh.s

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

Drupal Security Team — Wed, 07 Oct 2026 16:17:00 +0000

Project:

Orphans Media

Project machine name:

orphans_media

Date:

2026-October-07

Security risk:

Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All

Vulnerability:

Unsupported

Affected versions:

CVE IDs:

CVE-2026-107253

Description:

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution:

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By:

Drew Webber (mcdruid) of the Drupal Security Team

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

Drupal Security Team — Wed, 07 Oct 2026 16:16:31 +0000

Project:

MathJax: LaTeX for Drupal

Project machine name:

mathjax

Date:

2026-October-07

Security risk:

Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default

Vulnerability:

Cross site scripting

Affected versions:

<4.1.2

CVE IDs:

CVE-2026-107252

Description:

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet.

The module ships with library configurations that do not escape JavaScript within the TeX it formats.

Notice: This release updates CDN URLs where possible and adds a system status warning for unsafe configurations. If you are unable to upgrade immediately, you can modify either the CDN URL or the custom MathJax JavaScript configuration according to the instructions in MathJax Safe-mode.

Solution:

Install the latest version:

If you use the MathJax module, upgrade to MathJax 4.1.2
Check the Drupal status report for MathJax module warnings. If "safe mode is not enabled" appears, the MathJax configuration couldn't be automatically updated. Read the information above to manually fix the configuration.

Reported By:

cilefen (cilefen) of the Drupal Security Team

Fixed By:

bchin
cilefen (cilefen) of the Drupal Security Team

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Drupal Security Team — Wed, 07 Oct 2026 16:16:05 +0000

Project:

Entity Reference Manager (Merge entities)

Project machine name:

entity_reference_manager

Date:

2026-October-07

Security risk:

Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<1.0.3

CVE IDs:

CVE-2026-107251

Description:

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system.

The module does not sufficiently restrict access to all entity management operations. Users who can view content can access the entity merge functionality and delete arbitrary nodes, taxonomy terms, or media entities.

Solution:

Install the latest version:

If you use the Entity Reference Manager module, upgrade to Entity Reference Manager 1.0.3

Reported By:

Joshua Sedler (grevil)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team

ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

Drupal Security Team — Wed, 07 Oct 2026 16:15:35 +0000

Project:

ECA Helper

Project machine name:

eca_helper

Date:

2026-October-07

Security risk:

Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All

Vulnerability:

Unsupported

Affected versions:

CVE IDs:

CVE-2026-107250

Description:

Solution:

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By:

Luke Leber (luke.leber)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

Drupal Security Team — Wed, 07 Oct 2026 16:14:51 +0000

Project:

Block AJAX

Project machine name:

block_ajax

Date:

2026-October-07

Security risk:

Highly critical 20 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All

Vulnerability:

PHP object injection

Affected versions:

<3.0.2

CVE IDs:

CVE-2026-107249

Description:

The Block AJAX module enables you to load blocks asynchronously via Ajax.

The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution.

The vulnerability is mitigated by the fact that it only affects sites that have Layout Builder enabled (or another block plugin that handles the data this module passes to it in a potentially unsafe way).

Please see the release notes for details of potentially breaking changes.

Solution:

Install the latest version:

If you use the "block_ajax" module, upgrade to block_ajax 3.0.2

Reported By:

Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

Drupal Security Team — Wed, 23 Sep 2026 17:24:33 +0000

Project:

Diba carousel slider

Project machine name:

diba_carousel

Date:

2026-September-23

Security risk:

Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon

Vulnerability:

Cross Site Scripting (XSS)

Affected versions:

<3.0.2

CVE IDs:

CVE-2026-96382

Description:

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration.

When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms.

This vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the "Allow HTML description" option.

Solution:

Upgrade to the latest version:

If you are using Diba carousel slider 3.1.x, upgrade to Diba carousel slider 3.1.0.
If you are using Diba carousel slider 3.0.x, upgrade to Diba carousel slider 3.0.2.

If you are unable to upgrade immediately, disable the "Allow HTML description" option in affected carousel blocks until the update can be applied.

Reported By:

Kalle Kipinä (kekkis)

Fixed By:

Oriol Roselló Castells (oriol_e9g)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Drupal Security Team — Wed, 23 Sep 2026 17:23:37 +0000

Project:

Smart Content

Project machine name:

smart_content

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<3.2.1

CVE IDs:

CVE-2026-96386

Description:

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.

The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.

This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.

Solution:

Install the latest version:

Upgrade to Smart Content 3.2.1.

Reported By:

Tin Nguyen Huu (s4m0y3d)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Drupal Security Team — Wed, 23 Sep 2026 17:22:38 +0000

Project:

CSS Usage Analyzer

Project machine name:

css_usage_analyzer

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All

Vulnerability:

Improper access control

Affected versions:

>=1.0.0 <1.0.2

CVE IDs:

CVE-2026-96380

Description:

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics.

This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions.

Solution:

Install the latest version:

Upgrade to CSS Usage Analyzer 1.0.2.

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Greg Knaddison (greggles) of the Drupal Security Team
Marcus Johansson (marcus_johansson)
Zeeshaan khann (zeeshan_khan)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Drupal Security Team — Wed, 23 Sep 2026 17:21:51 +0000

Project:

Combined image style

Project machine name:

combined_image_style

Date:

2026-September-23

Security risk:

Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All

Vulnerability:

Improper access control

Affected versions:

<1.0.7

CVE IDs:

CVE-2026-96377

Description:

This module enables you to combine multiple image styles into a single image derivative.

The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token, potentially leading to a denial of service.

Sites are affected simply by having the module installed, even when no combined image styles are configured or in use.

This vulnerability is mitigated by the fact that only public files can be targeted, and derivatives of private files are still protected by core's token check.

Solution:

Install the latest version:

If you use the Combined image style module, upgrade to Combined image style 1.0.7.

Reported By:

Sven Decabooter (svendecabooter)

Fixed By:

Sven Decabooter (svendecabooter)
Swan Kalata (akalata) of the Drupal Security Team

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

Drupal Security Team — Wed, 23 Sep 2026 17:20:32 +0000

Project:

AI CKEditor

Project machine name:

ai_ckeditor

Date:

2026-September-23

Security risk:

Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default

Vulnerability:

Code execution via Twig templates

Affected versions:

<1.4.3

CVE IDs:

CVE-2026-96392

Description:

This module enables you to use AI to fill in or replace text in CKEditor.

The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data.

Solution:

Install the latest version:

If you use the AI CKEditor module, upgrade to AI CKEditor 1.4.3.

Reported By:

Stef Rouschop (stefro)

Fixed By:

Coordinated By:

Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Dave Long (longwave) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Drupal Security Team — Wed, 23 Sep 2026 17:19:41 +0000

Project:

Webform REST

Project machine name:

webform_rest

Date:

2026-September-23

Security risk:

Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon

Vulnerability:

Access bypass

Affected versions:

<4.2.1

CVE IDs:

CVE-2026-96391

Description:

This module enables you to retrieve and submit webforms via REST.

The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.

Solution:

Install the latest version:

Upgrade to Webform REST 4.2.1. The 4.1.x branch is no longer supported.

Reported By:

Lauri (laurii)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
cilefen (cilefen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Drupal Security Team — Wed, 23 Sep 2026 17:18:31 +0000

Project:

Editoria11y Accessibility Checker

Project machine name:

editoria11y

Date:

2026-September-23

Security risk:

Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<2.2.23 || >=3.0.0 <3.0.9

CVE IDs:

CVE-2026-96390

Description:

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API.

The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass.

Solution:

If you use the Editoria11y module, update the module and review permissions.

If you use the Editoria11y module version 2.2.x, upgrade to editoria11y 2.2.23.
If you use the Editoria11y module version 3.0.x, upgrade to editoria11y 3.0.9.

Review permissions: Make sure anonymous or untrusted authenticated users have not been given permission to use the checker. The permission is labeled as:

View Editoria11y checker up to and including 2.2.22/3.0.8, and
Run Editoria11y checker and report results with 2.2.23/3.0.9.

Reported By:

Maksim Hayder (tr_jan)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Drupal Security Team — Wed, 23 Sep 2026 17:14:48 +0000

Project:

Tawk.to - Live chat application

Project machine name:

tawk_to

Date:

2026-September-23

Security risk:

Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Cross Site Request Forgery

Affected versions:

<3.0.4

CVE IDs:

CVE-2026-96388

Description:

This module provides integration of the tawk.to live chat for Drupal sites.

The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

Solution:

Install the latest version:

Upgrade to tawk.to 3.0.4.

After updating, clear the Drupal cache.

Reported By:

Tin Nguyen Huu (s4m0y3d)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Damien McKenna (damienmckenna) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

Drupal Security Team — Wed, 23 Sep 2026 17:11:27 +0000

Project:

Stop administrator login

Project machine name:

stop_admin

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

>=1.0 <1.6

CVE IDs:

CVE-2026-96387

Description:

This module enables sites to block access for the administrative user account (user 1) or users with the administrator role.

The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be able to authenticate through certain alternative authentication methods.

This vulnerability is mitigated by the fact that an attacker must possess valid credentials for a user with the administrator role, and must authenticate using a less commonly used authentication mechanism.

Solution:

Install the latest version:

If you use the Stop Administrator Login module, upgrade to Stop Administrator Login 8.x-1.6

Reported By:

Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By:

Bram Driesen (bramdriesen) of the Drupal Security Team

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Pierre Rudloff (prudloff) of the Drupal Security Team

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Drupal Security Team — Wed, 23 Sep 2026 17:10:00 +0000

Project:

REST & JSON API Authentication for Drupal

Project machine name:

rest_api_authentication

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

<3.2.0

CVE IDs:

CVE-2026-96385

Description:

This module enables you to add an extra authentication layer to the API.

The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability.

Solution:

Install the latest version:

Upgrade to REST & JSON API Authentication 3.2.0.

Reported By:

Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

Drew Webber (mcdruid) of the Drupal Security Team
purva_shende

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Heine Deelstra (heine) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

Drupal Security Team — Wed, 23 Sep 2026 17:08:11 +0000

Project:

CookieCuttr

Project machine name:

cookiecuttr

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Cross-site scripting

Affected versions:

>=2.0.0 <2.0.3

CVE IDs:

CVE-2026-96379

Description:

This module enables you to provide information and options about cookie usage.

The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission administer cookiecuttr.

Solution:

Install the latest version:

Upgrade to cookiecuttr 2.0.3.

Reported By:

Swan Kalata (akalata) of the Drupal Security Team
Marcus Johansson (marcus_johansson)

Fixed By:

Malcolm Young (malcomio)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

Drupal Security Team — Wed, 23 Sep 2026 17:07:17 +0000

Project:

Mermaid Diagram Field

Project machine name:

mermaid_diagram_field

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

>=1.0.4 <1.0.9

CVE IDs:

CVE-2026-96384

Description:

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal.

The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content.

This vulnerability is mitigated by the fact that an attacker must have the modal display option enabled for the field, or otherwise know the route of the modal and entity ID.

Solution:

Install the latest version:

If you use the Mermaid Diagram Field module, upgrade to Mermaid Diagram Field 1.0.10.

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Steve Wirt (swirt)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Drupal Security Team — Wed, 23 Sep 2026 17:06:19 +0000

Project:

Commerce Decoupled Checkout

Project machine name:

commerce_decoupled_checkout

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All

Vulnerability:

Access bypass

Affected versions:

>=1.0.0 <1.8.0

CVE IDs:

CVE-2026-96378

Description:

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.

The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.

Solution:

Install the latest version of the module:

Update to Commerce Decoupled Checkout 8.x-1.8.

The standard order fields type, email, store, and order_items remain accepted by default.

Sites submitting additional custom order fields must explicitly enable them at /admin/commerce/config/decoupled-checkout. Requests containing fields outside this allowlist will be rejected.

Run database updates and configure the required customer-writable fields before resuming checkout.

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

Drupal Security Team — Wed, 23 Sep 2026 16:53:01 +0000

Project:

Project Browser

Project machine name:

project_browser

Date:

2026-September-23

Security risk:

Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Cross-site request forgery

Affected versions:

<2.0.3 || >=2.1.0 <2.1.5

CVE IDs:

CVE-2026-96374

Description:

The Project Browser module enables you to apply recipes and enable modules from the web user interface.

The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF).

Solution:

Install the latest version:

If you use the 2.1.x branch, upgrade to Project Browser 2.1.5.
If you use the 2.0.x branch, upgrade to Project Browser 2.0.3.

Reported By:

Tin Nguyen Huu (s4m0y3d)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

Drupal Security Team — Wed, 23 Sep 2026 16:51:09 +0000

Project:

Cloud

Project machine name:

cloud

Date:

2026-September-23

Security risk:

Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon

Vulnerability:

Remote code execution

Affected versions:

<7.0.1

CVE IDs:

CVE-2026-96376

Description:

The Cloud module enables users to manage cloud resources through Drupal.

The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary operating-system commands as the web-server user.

This vulnerability is mitigated by the fact that the Kubernetes submodule must be enabled and configured, Git must be available on the server, and an attacker must have permission to add or edit cloud server templates. Exploiting the clone path additionally requires the "launch cloud server template" permission, or the "launch approved cloud server template" permission when using the approved-template flow.

Solution:

Install the latest version:

If you use Cloud 7.x, upgrade to Cloud 7.0.1.

Reported By:

Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

AI Yas (ai_yas)
Drew Webber (mcdruid) of the Drupal Security Team
Yas Naoi (yas)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

Drupal Security Team — Wed, 23 Sep 2026 16:50:15 +0000

Project:

Cloud

Project machine name:

cloud

Date:

2026-September-23

Security risk:

Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All

Vulnerability:

Remote code execution

Affected versions:

<7.0.1

CVE IDs:

CVE-2026-96375

Description:

The Cloud module enables users to manage cloud infrastructure through Drupal.

The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials, potentially allowing unauthorized access to the connected infrastructure.

Solution:

If you use Cloud, install the latest version and configure certificates appropriately:

If you use the 7.0.0 branch, update to 7.0.1.

The update enables TLS certificate verification for Kubernetes and VMware connections. Sites using a private certificate authority must configure the CA certificate path for the affected connection or ensure that the issuing CA is trusted by the PHP runtime. Run the Drupal database updates and rebuild caches after upgrading.

Reported By:

Kalle Kipinä (kekkis)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Drupal Security Team — Wed, 23 Sep 2026 16:27:38 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Critical 18 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon

Vulnerability:

Remote Code Execution

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96355

Description:

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.

Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution.

This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

Michael Maturi (michaelmaturi)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Drupal Security Team — Wed, 23 Sep 2026 16:27:21 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon

Vulnerability:

Access bypass

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96356

Description:

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended to grant submission access only to selected user accounts could also grant access to anonymous users.

This vulnerability is mitigated by the fact that the bypass depends on malformed saved access-rule configuration.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
cilefen (cilefen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Lee Rowlands (larowlan) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Drupal Security Team — Wed, 23 Sep 2026 16:27:04 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon

Vulnerability:

Access bypass

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96398

Description:

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more permissive view mode and see fields that would otherwise be restricted.

This vulnerability is mitigated by the fact that an attacker must already have access to view the affected submission.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

Mustafa Ahmed (mustafa007)

Fixed By:

Coordinated By:

Bram Driesen (bramdriesen) of the Drupal Security Team
cilefen (cilefen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Drupal Security Team — Wed, 23 Sep 2026 16:26:49 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default

Vulnerability:

Cross-site scripting

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96357

Description:

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files.

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that a user with permission to create or edit webforms must configure the form to allow the affected file extensions, and a user must specifically open the uploaded file.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

Michael Maturi (michaelmaturi)

Fixed By:

Jacob Rockowitz (jrockowitz)
Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

Drupal Security Team — Wed, 23 Sep 2026 16:26:32 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Exploit/TD:Uncommon

Vulnerability:

Access bypass

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96364

Description:

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The Webform Share submodule can expose a webform for embedding on another site.

Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.

This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

karing

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Damien McKenna (damienmckenna) of the Drupal Security Team
Mori Sugimoto (dokumori) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Drupal Security Team — Wed, 23 Sep 2026 16:26:17 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Less critical 8 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon

Vulnerability:

Denial of service

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96365

Description:

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks.

Webform does not sufficiently validate an optional token query value before using it. Under specific configurations where a Webform is rendered for anonymous visitors, a malicious request can cause the request to consume significant resources leading to a Denial of Service.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

Majdi Alomari (majdi)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
cilefen (cilefen) of the Drupal Security Team
Damien McKenna (damienmckenna) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Drupal Security Team — Wed, 23 Sep 2026 16:25:53 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default

Vulnerability:

Access bypass

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96366

Description:

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments.

In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view.

This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

Fixed By:

Jacob Rockowitz (jrockowitz)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
cilefen (cilefen) of the Drupal Security Team
Damien McKenna (damienmckenna) of the Drupal Security Team
Heine Deelstra (heine) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Drupal Security Team — Wed, 23 Sep 2026 16:20:24 +0000

Project:

Webform

Project machine name:

webform

Date:

2026-September-23

Security risk:

Moderately critical 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default

Vulnerability:

Access bypass

Affected versions:

<6.2.12 || >=6.3.0 <6.3.1

CVE IDs:

CVE-2026-96373

Description:

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view submission results for one webform may be able to access or remove files from the configured export temporary directory that were not generated for that webform.

This vulnerability is mitigated by the fact that an attacker must have access to view submission results for a webform and must know or be able to determine a target filename.

Solution:

Install the latest version:

If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By:

Marcus Johansson (marcus_johansson)

Fixed By:

Jacob Rockowitz (jrockowitz)

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Pierre Rudloff (prudloff) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team