Drupal Security
S3 File System CORS Upload - Critical - Access bypass - SA-CONTRIB-2026-295
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
Solution:Install the latest version:
- Upgrade to S3 File System CORS Upload 8.x-1.3.
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Content Synchronizer - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-294
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.
Solution:Install the latest version:
- Upgrade to Content Synchronizer 4.1.1.
- Drew Webber (mcdruid) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Content Synchronizer - Critical - Remote code execution - SA-CONTRIB-2026-293
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.
Solution:Install the latest version:
- Upgrade to Content Synchronizer 4.1.1.
- Drew Webber (mcdruid) of the Drupal Security Team
- Oleh Shevchuk (alt.dev)
- Bohdan Artemchuk (bohart)
- Drew Webber (mcdruid) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
GroupEx PRO ( Daxko ) integration - Critical - PHP object injection - SA-CONTRIB-2026-278
Integration with GroupEx PRO system, decoupled from Open Y.
The module does not sufficiently validate user inputs in some scenarios, potentially leading to arbitrary remote code execution.
Note: This project was marked as Unsupported by the Drupal Security Team on 2026-10-28 but a fix was released and the project restored on 2026-11-04.
Solution:Install the latest version:
- If you use GroupEx PRO module upgrade to GroupEx PRO 2.2.1.
- Drew Webber (mcdruid) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Security support for Drupal core minor versions reduced to 8 months - PSA-2026-11-02
Drupal has supported each minor release of Drupal (example: 11.3, 11.4) for 12 months each since the release of Drupal 8.6 in 2018.
Like all open source projects, Drupal is enduring a "tsunami" of security reports due to the prevalence of AI tools, and this has created more work than the Drupal Security Team, especially with its current levels of funding, can sustain. For site owners, this introduces risks that security fixes will take longer to release, which gives more time for malicious actors armed with LLMs to find attacks.
The Drupal Security Team and Drupal core release managers explored several options, and ultimately landed on a compromise that brings other benefits such as better alignment with Symfony upstream releases. We will continue protecting Drupal sites for at least 4 years on each major version, while cutting backport work for core security advisories by 30%.
Drupal minor versions will receive 8 months of security coverageBeginning in 2027, Drupal minor versions will receive 8 months of overlapping security coverage (rather than 12 months). This will apply to all versions supported in 2027, meaning that:
- Drupal 11.3 (released December 2025) will still be supported until December 2026.
- Drupal 11.4 (released June 2026) will be supported until April 2027 while the old schedule is being phased out.
- Drupal 12.0 and 11.5 (scheduled for December 2026) will be supported until August 2027.
- Drupal 12.1 and 11.6 (scheduled for June 2027) will be supported until February 2028.
Each minor version will have six months of bugfix support followed by two months of security-only support. The final minor version for each major receives six months of bugfix support followed by six months of security support.
Major versions are still supported for at least 4 yearsWhile the duration of overlapping support for individual minor versions will be reduced, major versions of Drupal core will still be supported for at least four years. This means that:
- Drupal 10 will still be supported until December 2026.
- Drupal 11 (released August 2024) will still be supported until December 2028.
- Drupal 12 (scheduled for December 2026) will be supported until December 2030.
- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Gábor Hojtsy (gábor hojtsy)
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- quietone (quietone)
- Angie Byron (webchick) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292
This module allows for direct viewing of a file with the URL alias.
This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability.
In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.
This vulnerability is mitigated by the following:
- Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.
- An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached.
Install the latest version:
Reported By:- Pierre Rudloff (prudloff) of the Drupal Security Team
- Timothy Dickens (tregonia)
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291
This module enables you to share and reuse content across websites.
The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password.
This vulnerability is mitigated by the fact that an attacker must have access to a database dump or database read access to the user data table. This vulnerability is not exploitable without prior database access.
Solution:Install the latest version:
- If you use the cms_content_sync module, upgrade to cms_content_sync 3.2.2.
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290
This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback.
The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to an account they control.
This vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs).
Solution:Install the latest version:
- If you use the OAuth2 Token Manager module, upgrade to OAuth2 Token Manager 8.x-1.2
After updating, run database updates. If you suspect your Box, Quip or Slack integration was connected to an unauthorized account, re-initialize the system token with Drush.
Reported By: Fixed By: Coordinated By:- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289
The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting.
The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field configured as "Private" on one of these entities can be viewed. Where the entity is editable, the entity can also be edited by anyone who can view it, including anonymous users.
This vulnerability is mitigated by the fact that an administrator must have configured a field as "Private" on an entity type that has no author, and the attacker must already be able to view that entity. Fields set to "Private" on nodes, users, media, comments, and other entity types with an author are not affected. Fields using Custom permissions are not affected.
Solution:Install the latest version:
- If you use the Field Permissions module for Drupal 9.5, 10 or 11, upgrade
to Field Permissions 8.x-1.6.
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288
This module enables you to set field-level permissions to create, update or view individual fields.
The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.
This vulnerability is mitigated by the fact that an attacker must have a role with the machine name administrator that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected.
Solution:Install the latest version:
- If you use the Field Permissions module, upgrade to Field Permissions 8.x-1.6.
- Jakob P (japerry)
- Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
- narbehm
- Rob Loach (robloach)
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287
The module enables authentication via the OpenID Connect (oAuth2) protocol.
When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.
This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.
Solution:Install the latest version:
- Upgrade to OpenID Connect Client 2.3.1.
Linking new users to an existing account is now disabled by default and can be re-enabled on the settings page. When using a generic realm it's also highly recommended to configure the email verified claim.
Reported By: Fixed By: Coordinated By:- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286
Stage File Proxy is a general solution for getting production files on a development server on demand. It is not intended for usage on production sites.
The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module.
Solution:Install the latest version:
- If you use the stage_file_proxy module, upgrade to Stage File Proxy 4.0.1 or
Stage File Proxy 3.1.7
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285
This module enables users to create and save signatures as SVG images.
The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.
Solution:Install the latest version:
- If you use the sign_widget module for Drupal 10.x/11.x, upgrade to Sign Widget 8.x-1.15
- Marcus Johansson (marcus_johansson)
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
- Joseph Olstad (joseph.olstad)
- Marcus Johansson (marcus_johansson)
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284
This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider.
The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an attacker log in as any existing user whose email address they know.
This vulnerability is mitigated by the fact that an attacker must have an account with an identity provider the site is configured to use. They must also be able to set the value of at least one attribute that provider returns, such as a username.
Solution:Install the latest version:
- If you use the OAuth Login - OAuth OIDC SSO module, upgrade to OAuth Login - OAuth OIDC SSO-3.1.1.
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280
This module provides a bulk form for assigning or removing roles on multiple user accounts at once.
The bulk update form does not prevent access to users who do not have permission to assign roles.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users".
Solution:Install the latest version:
- If you use the Bulk Update User Roles module for Drupal 11, upgrade to Bulk Update User Roles 1.0.5
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279
S3 File System (s3fs) provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service (S3) storage.
The module doesn't sufficiently isolate upload context between separate object(file) operations in the same request resulting in the potential for objects to be uploaded with incorrect access control list (ACL) entries or corruption through incorrect operation metadata.
This vulnerability is mitigated by the fact that an attacker must be able to trigger multiple file operations on S3FS.
Some vectors are mitigated by:
- Not enabling private:// takeover ($settings['s3fs.use_s3_for_private'] = FALSE;) or only enabled with $settings['s3fs.upload_as_private'] = TRUE;
- The deployment does not utilize hook_s3fs_stream_open_params_alter(), hook_s3fs_upload_params_alter(), hook_s3fs_copy_params_alter(), or hook_s3fs_command_params_alter()
If both points above have always been true, all currently known vectors are mitigated.
Solution:Install the latest version:
- If you use the S3 File System module for Drupal 8.x, upgrade to s3fs 8.x-3.12
If private:// takeover is enabled without $settings['s3fs.upload_as_private'] = TRUE; audit all private object ACL's to ensure no objects include a public read ACL entry. If private objects with public read ACL are discovered, audit S3 Bucket Access logs (if enabled).
If using S3FS hooks, audit all objects to ensure any applied customization is reflected only on the intended objects.
While auditing objects, site owners may disable ACLs and utilize a Bucket Access Policy to block public access to private:// files. See the s3fs 8.x-3.12 README.txt for a sample policy. $settings['s3fs.use_s3_for_private'] = TRUE; must be configured prior to disabling ACLs.
Note: With ACLs disabled, the S3 getObjectAcl call will not report ACL entries. If this feature is enabled, consider utilizing an AWS S3 Inventory report to obtain object metadata.
Reported By: Fixed By: Coordinated By:- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.
The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while logged in. This allows the attacker to change the publication status of arbitrary content on behalf of that user.
This vulnerability is mitigated by the fact that an attacker must trick a user with the permission "Use Fasttoggle" into visiting an attacker-controlled page.
Solution:Install the latest version:
- If you use the Fasttoggle module, upgrade to Fasttoggle 4.1.1
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282
This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.
The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle" permission submits a request to the toggle URL for any node or comment regardless of their permission to update that entity. For example, such a user could publish an unpublished draft they are not allowed to view.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Use Fasttoggle".
Solution:Install the latest version:
- If you use the Fasttoggle module, upgrade to Fasttoggle 4.1.1
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281
The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.
The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.
This is a follow-up to the earlier CAPTCHA replay fix (SA-CONTRIB-2026-015 / CVE-2026-3214), which closed one replay path but left this one open.
Solution:Install the latest version:
- If you use the Captcha module 2.0.x, upgrade to Captcha 2.0.11.
- If you use the Captcha module 8.x-1.x, upgrade to Captcha 8.x-1.18.
- James Gilliland (neclimdul) of the Drupal Security Team
- Rodrigo Cabo (rodrigo-cabo)
- Jakob P (japerry)
- James Gilliland (neclimdul) of the Drupal Security Team
- Rob Loach (robloach)
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Michael Hess (mlhess) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Stella Power (stella) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Solution:If you use this project, you should uninstall it.
To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.
Reported By:- Drew Webber (mcdruid) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Neue Kommentare
vor 6 Tagen 8 Stunden
vor 6 Tagen 14 Stunden
vor 6 Tagen 21 Stunden
vor 1 Woche 1 Tag
vor 1 Woche 1 Tag
vor 6 Wochen 6 Tagen
vor 7 Wochen 2 Tagen
vor 7 Wochen 4 Tagen
vor 7 Wochen 6 Tagen
vor 7 Wochen 6 Tagen