From security-news at drupal.org Wed Feb 4 17:23:41 2026 From: security-news at drupal.org (security-news at drupal.org) Date: Wed, 4 Feb 2026 17:23:41 +0000 (UTC) Subject: [Security-news] Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008 Message-ID: View online: https://www.drupal.org/sa-contrib-2026-008 Project:?Login Disable [1] Date:?2026-February-04 Security risk:?*Less critical* 8???25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability:?Access bypass Affected versions:?<2.1.3 CVE IDs:?CVE-2026-1917 Description:? The Login Disable module prevents users from logging in to your Drupal site unless they know the access key to add to the end of the login form page. ( default: http://example.com/user/login?admin [3] ) If they provide the access key and have a specific role they can log in. The module does not check for the access key when using the HTTP request login route. It is possible to use this route to log in without providing the access key. Solution:? Install the latest version: * If you use the Login Disable module, upgrade to Login Disable 2.1.3 [4] Reported By:? * Pierre Rudloff (prudloff) [5] provisional member of the Drupal Security Team Fixed By:? * Boris Doesborg (batigolix) [6] * Pierre Rudloff (prudloff) [7] provisional member of the Drupal Security Team Coordinated By:? * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] provisional member of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/login_disable [2] https://www.drupal.org/security-team/risk-levels [3] http://example.com/user/login?admin [4] https://www.drupal.org/project/login_disable/releases/2.1.3 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/batigolix [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3571527 From security-news at drupal.org Wed Feb 11 16:53:34 2026 From: security-news at drupal.org (security-news at drupal.org) Date: Wed, 11 Feb 2026 16:53:34 +0000 (UTC) Subject: [Security-news] Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009 Message-ID: View online: https://www.drupal.org/sa-contrib-2026-009 Project:?Quick Edit [1] Date:?2026-February-11 Security risk:?*Moderately critical* 14???25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability:?Cross-site Scripting Affected versions:?<1.0.5 || >=2.0.0 <2.0.1 CVE IDs:?CVE-2026-2348 Description:? This module allows content to be edited in-place. The module doesn't sufficiently sanitize certain image-related values during the editing process leading to a persistent Cross-site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to create or edit an affected field. Solution:? Install the latest version: * If you use the QuickEdit module for Drupal 9, upgrade to 2.0.1 [3] or 1.0.5 [4] Reported By:? * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By:? * Derek Wright (dww) [6] * Vladimir Roudakov (vladimiraus) [7] Coordinated By:? * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/quickedit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/quickedit/releases/2.0.1 [4] https://www.drupal.org/project/quickedit/releases/1.0.5 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/dww [7] https://www.drupal.org/u/vladimiraus [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3572897 From security-news at drupal.org Wed Feb 11 16:54:20 2026 From: security-news at drupal.org (security-news at drupal.org) Date: Wed, 11 Feb 2026 16:54:20 +0000 (UTC) Subject: [Security-news] UI Icons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-010 Message-ID: View online: https://www.drupal.org/sa-contrib-2026-010 Project:?UI Icons [1] Date:?2026-February-11 Security risk:?*Moderately critical* 14???25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability:?Cross-site Scripting Affected versions:?<1.0.1 || >=1.1.0 <1.1.1 CVE IDs:?CVE-2026-2349 Description:? This module enables you to integrate and manage icons with Drupal. The module doesn't sufficiently sanitize user input leading to a reflected Cross-site Scripting (XSS) vulnerability. The vulnerability is mitigated by the fact that in order to be vulnerable, the "UI Icons for CKEditor 5" submodule must be enabled. Solution:? Install the latest version: * If you use the UI Icons module upgrade to UI Icons 1.0.1 [3] or UI Icons 1.1.1 [4] Reported By:? * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By:? * Jean Valverde (mogtofu33) [6] Coordinated By:? * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ui_icons [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ui_icons/releases/1.0.1 [4] https://www.drupal.org/project/ui_icons/releases/1.1.1 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/mogtofu33 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3572898