Drupal Security
Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113
The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties.
The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability.
This vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module.
Solution:Install the latest version:
- If you use the Entity API module, upgrade to Entity API 8.x-1.8.
- Sascha Grossenbacher (berdir)
- Klaus Purer (klausi)
- Kristiaan Van den Eynde (kristiaanvandeneynde)
- Matt Glaman (mglaman)
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.
The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via drupalSettings.
This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.
Solution:Install the latest version:
- If you use the 2.x branch of the DXPR Builder module, upgrade to DXPR Builder 2.8.1 or later.
- The 3.x branch is not affected as it proxies AI requests through the contributed AI module.
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
This module enables you to disable access to the /user/login form unless a secret key is provided.
The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared. An attacker may continue to access the login page despite the restriction having been enabled.
Solution:Install the latest version:
- If you use the Disable Login Page module, upgrade to Disable Login Page 1.1.4.
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
This module enables you to disable access to the /user/login form unless a secret key is provided.
The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism.
Solution:Install the latest version:
- If you use the Disable Login Page module, upgrade to Disable Login Page 1.1.4.
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display.
The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous visitor could read the rendered content of blocks they were not meant to see.
This vulnerability is mitigated by the fact that many block plugins perform their own access checks on the content they display, which limits what can be disclosed through this route.
Solution:Install the latest version:
- If you use Digital Signage Framework 2.6.x, update to 2.6.1.
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.
The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.
Solution:Install the latest version:
- If you use the Data Field module, upgrade to Data Field 2.0.13
- Marcus Johansson (marcus_johansson)
- Drew Webber (mcdruid) of the Drupal Security Team
- Steven Jones (steven jones)
- Joseph Olstad (joseph.olstad)
- NGUYEN Bao (lazzyvn)
- Marcus Johansson (marcus_johansson)
- Steven Jones (steven jones)
- Swan Kalata (akalata) of the Drupal Security Team
- David Stoline (dstol)
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107
The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted.
A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators.
Solution:Install the latest version:
- If you use Content Moderation Notifications, upgrade to version 8.x-3.9.
- Review roles to ensure only trusted roles have access to the "administer content moderation notifications" permission.
changed.
Reported By:- Lee Rowlands (larowlan) of the Drupal Security Team
- Luke Leber (luke.leber)
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
This module integrates Drupal Commerce with the CyberSource payment gateway.
The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't.
This issue only affects the Secure Acceptance Hosted Checkout gateway integration.
Solution:Install the latest version:
- If you use the Commerce CyberSource module, upgrade to Commerce CyberSource 8.x-1.10.
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
This module enables site administrators to require CAPTCHA confirmation on specific pages.
The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirely.
Solution:Install the latest version:
- If you use the CAPTCHA Protected Page module, upgrade to CAPTCHA Protected Page 1.0.2.
- Swan Kalata (akalata) of the Drupal Security Team
- Carlo Miguel Agno (carlagno)
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104
This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode.
The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view.
The issue is mitigated by the fact that the shortcode does not expose the entire entity. Only fields that the shortcode can render are vulnerable.
Solution:Install the latest version:
- If you use the Blazy module for Drupal, upgrade to Blazy 3.0.18.
- Drew Webber (mcdruid) of the Drupal Security Team
- Gaus Surahman (gausarts)
- Drew Webber (mcdruid) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103
The Address Suggestion module provides address autocomplete functionality using configured address providers.
The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must be able to inject malicious content into data returned by a configured address provider, and a user must perform a search that returns the malicious suggestion.
Solution:Install the latest version:
- If you use the address_suggestion module, upgrade to address_suggestion 1.0.25.
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Solution:If you use this project, you should uninstall it.
To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.
Reported By: Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Solution:If you use this project, you should uninstall it.
To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.
Reported By:- Drew Webber (mcdruid) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Solution:If you use this project, you should uninstall it.
To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.
Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance.
The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and performed no access check for reusable custom blocks. Content that should have been denied was therefore rendered — for example, an unpublished node or unpublished reusable custom block could be shown to users without permission to view it.
The access bypass is mitigated by the fact that affected content is selected by a user with the “administer quicktabs” permission when the tab is configured, so an attacker cannot choose which content is exposed.
Solution:Install the latest version:
- If you use the Quick Tabs module for Drupal, upgrade to Quick Tabs 4.3.1
- Swan Kalata (akalata) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers.
The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations.
This vulnerability is minimally mitigated by the fact that it affects only sites using impacted MySQL or MariaDB collation settings for the module’s authentication mapping storage. Affected collations are quite common so all sites are encouraged to upgrade.
Solution:Install the latest version:
- If you use the externalauth module for Drupal, upgrade to 2.0.13
- Swan Kalata (akalata) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
This module enables you to share content between sites in a hub - subscriber model.
Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks.
Solution:Install the latest version:
- If you use the Entity Share Websub module for Drupal 9.x or 10.x, upgrade to Entity Share Websub 1.1.2
- Swan Kalata (akalata) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
This module enables you to view the differences between revisions on any entity type.
The module doesn't sufficiently restrict access to non-node entity revision diffs.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity.
Solution:Install the latest version:
- If you use the Diff module, upgrade to Diff 2.1.1 or Diff 2.0.1
- Adam Bramley (acbramley)
- Derek Wright (dww)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
This module enables you to pay for Commerce transactions using Paypal.
The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment.
This vulnerability only affects sites using the Payflow Link payment gateway.
Solution:- If you use the Commerce Paypal module for Drupal, upgrade to Commerce Paypal 2.1.3 or Commerce Paypal 8.x-1.12
- Jonathan Sacksick (jsacksick)
- Kimberley Massey (kimberleycgm)
- Ryan Szrama (rszrama)
- Tom Ashe (tomtech)
- Swan Kalata (akalata) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.
The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.
Solution:Install the latest version:
- If you use the Entity Browser module, upgrade to Entity Browser 8.x-2.16
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Julian Pustkuchen (anybody)
- Sascha Grossenbacher (berdir)
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
Neue Kommentare
vor 6 Stunden 24 Minuten
vor 16 Stunden 57 Minuten
vor 1 Tag 12 Stunden
vor 5 Tagen 19 Stunden
vor 9 Wochen 6 Tagen
vor 10 Wochen 3 Tagen
vor 10 Wochen 3 Tagen
vor 12 Wochen 6 Tagen
vor 13 Wochen 1 Tag
vor 13 Wochen 2 Tagen