Drupal Security
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.
Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.
For more information, see CKEditor's security advisory:
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.7.
- If you use Drupal 11.3.x, update to Drupal 11.3.17.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.17.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Note that Drupal 8 and Drupal 9 have both reached end-of-life.
Instructions for contributed modulesSite owners should also review their site following the protocol for managing external libraries and plugins, as contributed projects may use additional CKEditor plugins not packaged in Drupal core.
CKEditor has also released another CVE in today's release that does not affect Drupal, but may affect custom plugins or other usecases:
Reported By: Fixed By:- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.
The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.
This vulnerability is partially mitigated by the fact that only files with the pdf, doc and docx extensions are accepted.
Solution:Install the latest version and adjust permissions:
- If you use the 2.x branch of the Ultimate Table Field module , upgrade to Ultimate Table Field 2.0.1.
- If you use the 1.x branch of the Ultimate Table Field module , upgrade to Ultimate Table Field 1.1.1.
After updating, grant the new permission Use the Ultimate Table Field cell editor to every role that edits content containing an Ultimate Table field. Without it, editors can no longer open the cell editor dialog.
Releases of the 1.0.x branch are not supported and do not receive security coverage. Upgrade to 1.1.1 or 2.0.1.
Reported By: Fixed By: Coordinated By:- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
This module adds automatic highlighting of taxonomy terms in content.
The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise restricted.
Solution:Install the latest version:
- If you use the Taxonomy Term Glossary module, upgrade to term_glossary 4.6.0.
The 4.4.x and 4.5.x branches are no longer supported.
Reported By: Fixed By: Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity provider metadata could cause the application to make requests to unintended destinations, potentially allowing access to internal network resources.
This vulnerability is mitigated by the fact that an attacker must have permission to configure identity provider metadata.
Solution:Install the latest version:
- Upgrade to miniorange_saml 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be replayed within its validity period, potentially allowing repeated authentication attempts using the same assertion.
This vulnerability is mitigated by the fact that an attacker must first obtain a valid SAML assertion and can only reuse it during the assertion's validity period.
Solution:Install the latest version:
- Upgrade to miniorange_saml 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related system data.
This vulnerability is mitigated by the fact that an attacker must first obtain access to configuration or underlying storage mechanisms.
Solution:Install the latest version:
- Upgrade to SAML SSO - Service Provider 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module contains embedded credentials used by the functionality provided by the module.
Under certain circumstances, these credentials could allow information about associated services to be disclosed.
Solution:Install the latest version:
- Upgrade to miniorange_saml 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity provider or an attacker able to supply crafted SAML attributes, leading to a cross-site scripting (XSS) vulnerability.
Solution:Install the latest version:
- Upgrade to miniorange_saml 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting vulnerability (XSS).
Solution:Install the latest version:
- Upgrade to SAML SSO - Service Provider 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenced by the incoming response rather than being tied to the type of key configured for the Identity Provider (IdP).
The vulnerability is mitigated by the fact that an attacker must be able to submit a crafted SAML response to the affected site.
Solution:Install the latest version:
- Upgrade to SAML SSO - Service Provider 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module uses cryptographic constructions that do not align with current security best practices.
The module performs certain signature comparisons using non constant-time comparison logic and generates SAML request identifiers using predictable values derived from non-cryptographic random number generation.
While no practical authentication bypass has been demonstrated as a result of these weaknesses alone, they may reduce the overall security margin of SAML authentication workflows.
Solution:Install the latest version:
- Upgrade to SAML SSO - Service Provider 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The miniorange_saml module does not sufficiently validate certain user-supplied URLs before performing redirects.
An attacker could cause users to be redirected to an external website after authentication. This could be used in phishing attacks or to increase the credibility of malicious links.
Solution:Install the latest version:
- Upgrade to miniorange_saml 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not properly validate TLS certificates when making outbound HTTPS requests.
An attacker in a position to intercept network traffic could impersonate a trusted remote service and influence communications performed by the module.
This vulnerability is mitigated by the fact that an attacker must be able to
intercept or redirect network traffic originating from the site.
Install the latest version:
- Upgrade to miniorange_saml 3.2.0
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The miniorange_saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow unauthorized users to access functionality or modify configuration values that should only be available to privileged users.
Solution:Install the latest version:
- Upgrade to SAML SSO - Service Provider 3.2.0.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
This module enables you to manage content deletion and provides reports for identifying orphaned content.
The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability (XSS).
This vulnerability is mitigated by the fact that an attacker must have permission to create content of a content type configured for the orphaned nodes report.
Solution:Install the latest version:
- If you use the Safe Delete module, upgrade to Safe Delete 1.0.88.
- Lee Rowlands (larowlan) of the Drupal Security Team
- Joseph Olstad (joseph.olstad)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Scott Morrison (scottm316)
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
Patreon - Critical - Unsupported - SA-CONTRIB-2026-139
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Solution:If you use this project, you should uninstall it.
To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.
Reported By: Coordinated By:- Bram Driesen (bramdriesen) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138
This module enables you to add key-based authentication on a per-user
basis.
The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.
This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled.
Solution:Install the latest version:
- If you use the Key Auth module, upgrade to Key auth 2.2.4.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed.
The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability.
Solution:Install the latest version:
- If you use the 3.x branch, upgrade to Feed Block 3.0.2.
- If you use the 2.x branch, upgrade to Feed Block 2.0.2.
- Greg Knaddison (greggles) of the Drupal Security Team
- Mark Fullmer (mark_fullmer)
- mmarler
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers.
The module did not sufficiently sanitize user-supplied values used in database queries, resulting in an SQL injection vulnerability.
This vulnerability is mitigated by the fact that an attacker needs access to an account with the Access CSP reports permission to exploit the SQL Injection.
Solution:Install the latest version:
- If you use the CSP Log module, upgrade to CSP Log 1.0.2.
- Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your database the primary location for other systems to use for authentication in a SSO environment.
The module doesn't sufficiently check the service URL used to redirect the user during logout, leading to an open redirect.
This vulnerability is mitigated by the fact that an attacker must convince a user to click a specially crafted link. The vulnerability cannot be exploited without user interaction and does not allow an attacker to directly compromise the CAS server or bypass authentication.
Solution:Install the latest version of Central Authentication System (CAS) Server module:
- If you use the 2.0.x branch, upgrade to CAS Server 2.0.4.
- If you use the 2.1.x branch, upgrade to CAS Server 2.1.3
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- nächste Seite ›
- letzte Seite »
Neue Kommentare
vor 2 Tagen 7 Stunden
vor 4 Tagen 20 Stunden
vor 5 Tagen 1 Stunde
vor 1 Woche 10 Minuten
vor 1 Woche 2 Tagen
vor 1 Woche 2 Tagen
vor 1 Woche 2 Tagen
vor 1 Woche 2 Tagen
vor 1 Woche 5 Tagen
vor 1 Woche 6 Tagen