Newsfeed-Generator
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance.
The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and performed no access check for reusable custom blocks. Content that should have been denied was therefore rendered — for example, an unpublished node or unpublished reusable custom block could be shown to users without permission to view it.
The access bypass is mitigated by the fact that affected content is selected by a user with the “administer quicktabs” permission when the tab is configured, so an attacker cannot choose which content is exposed.
Solution:Install the latest version:
- If you use the Quick Tabs module for Drupal, upgrade to Quick Tabs 4.3.1
- Swan Kalata (akalata) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers.
The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations.
This vulnerability is minimally mitigated by the fact that it affects only sites using impacted MySQL or MariaDB collation settings for the module’s authentication mapping storage. Affected collations are quite common so all sites are encouraged to upgrade.
Solution:Install the latest version:
- If you use the externalauth module for Drupal, upgrade to 2.0.13
- Swan Kalata (akalata) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
This module enables you to share content between sites in a hub - subscriber model.
Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks.
Solution:Install the latest version:
- If you use the Entity Share Websub module for Drupal 9.x or 10.x, upgrade to Entity Share Websub 1.1.2
- Swan Kalata (akalata) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
This module enables you to view the differences between revisions on any entity type.
The module doesn't sufficiently restrict access to non-node entity revision diffs.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity.
Solution:Install the latest version:
- If you use the Diff module, upgrade to Diff 2.1.1 or Diff 2.0.1
- Adam Bramley (acbramley)
- Derek Wright (dww)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
This module enables you to pay for Commerce transactions using Paypal.
The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment.
This vulnerability only affects sites using the Payflow Link payment gateway.
Solution:- If you use the Commerce Paypal module for Drupal, upgrade to Commerce Paypal 2.1.3 or Commerce Paypal 8.x-1.12
- Jonathan Sacksick (jsacksick)
- Kimberley Massey (kimberleycgm)
- Ryan Szrama (rszrama)
- Tom Ashe (tomtech)
- Swan Kalata (akalata) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.
The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.
Solution:Install the latest version:
- If you use the Entity Browser module, upgrade to Entity Browser 8.x-2.16
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Julian Pustkuchen (anybody)
- Sascha Grossenbacher (berdir)
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display (full content, teaser...).
The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission".
Solution:Install the latest version:
- If you use the Edit in-place field module for Drupal, upgrade to 2.1.1
- Drew Webber (mcdruid) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
The Token Content Access module enables site administrators to provide access to content using access tokens.
The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access restrictions for content protected by this module.
This vulnerability is mitigated by the fact that an attacker must know or discover a URL for content protected by Token Content Access, and exploiting the issue requires measuring timing differences in token comparison responses.
Solution:Install the latest version:
- If you use the Token Content Access module for Drupal 10.x/11.x, upgrade to Token Content Access 3.1.2
- Bram Driesen (bramdriesen) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters.
The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery display formatter, in versions < 3.0.4 (Drupal 8) or < 3.2.0 (Drupal 9 / Drupal 10).
This vulnerability is mitigated by the fact that it only affects sites limiting access to the images shown in photoswipe (the most common use case for photoswipe lightboxes public images).
Solution:Drupal 8 compatible version (3.0x.): Update to version 3.0.4 of the Photoswipe module.
Drupal 9 / Drupal 10 compatible version (3.1.x / 3.2.x): Ensure you're using version 3.2.0 or higher. 3.1.x is deprecated and should not be used anymore.
- cilefen (cilefen) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
This module enables you to retrieve and submit webform submissions via REST endpoints.
The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions.
This vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource.
This advisory only affects already-unsupported versions 4.0.3 and earlier.
Solution:Install the latest version:
- If you use the Webform Rest module for Drupal 8.x, upgrade to Webform Rest 4.1.0
- Version 4.2.0 already has the fix included so no action needed if you use that version
- Dan Chadwick (danchadwick)
- Giuseppe (giuseppe87)
- Jacob Rockowitz (jrockowitz)
- Liam Morland (liam morland)
- Nelson Alves (nsalves)
- Anna Kalata (akalata) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Michael Hess (mlhess) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Security advisory coverage removed - QA Accounts - PSA-2026-07-22
QA Accounts enables you to login to a Drupal site using a well known username/password combination. When 1.0 was released, it also was marked for security coverage. The module prioritizes ease of use rather than security and is only intended to be used on sites that are not accessible on the internet (e.g. behind firewall or other protection). The maintainers are choosing to remove security coverage.
Solution:Ensure qa_accounts is not enabled on any publicly available site.
Reported By: Fixed By:Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Reported By:- Pierre Rudloff (prudloff) of the Drupal Security Team
Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
This module enables you to add autocomplete suggestions for search forms created with the Search API module.
The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that the web server must be configured to display warning messages to users.
Solution:Install the latest version:
- If you use the Search API Autocomplete module, upgrade to Search API Autocomplete 8.x-1.12
Another option for sites unable to update is to set display_errors: off in php.ini (or similar settings) to disable the exploit.
Reported By: Fixed By: Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain.
The module doesn't sufficiently validate a short-lived token, allowing an attacker to bypass access control and authenticate as a victim user.
This vulnerability is mitigated by the fact that an attacker must appear to originate from the same client IP as the victim.
Solution:Install the latest version:
- If you use the Internationalization Single Sign-On module upgrade to i18n_sso 8.x-1.8
- Drew Webber (mcdruid) of the Drupal Security Team
- Florent Torregrosa (grimreaper)
- Drew Webber (mcdruid) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Neue Kommentare
vor 7 Wochen 10 Stunden
vor 7 Wochen 4 Tagen
vor 7 Wochen 4 Tagen
vor 10 Wochen 12 Stunden
vor 10 Wochen 2 Tagen
vor 10 Wochen 2 Tagen
vor 10 Wochen 5 Tagen
vor 14 Wochen 2 Stunden
vor 13 Wochen 6 Tagen
vor 13 Wochen 6 Tagen