Drupal Security

Project: AI translateProject machine name: ai_translateDate: 2026-September-02Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access BypassAffected versions: <1.3.2 || >=1.4.0 <1.4.1CVE IDs: CVE-2026-84913Description: 

This module enables you to automatically translate entities.

The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the parent entity. This permission bypass is only applicable to the translate operation - no unwarranted read or update access is granted to the affected entities

Solution: 

Install the latest version:

• If you use AI Translate 1.3.x, upgrade to AI Translate 1.3.2
• If you use AI Translate 1.4.x, upgrade to AI Translate 1.4.1

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Marcus Johansson (marcus_johansson)
• Sven Decabooter (svendecabooter)
• Valery Lourie (valthebald)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-September-02Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access BypassAffected versions: <1.3.13 || >=1.4.0 <1.4.8CVE IDs: CVE-2026-84912Description: 

This submodule AI Translate enables you to automatically translate entities.

The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the parent entity. This permission bypass is only applicable to the translate operation - no unwarranted read or update access is granted to the affected entities

Solution: 

Install the latest version:

• If you use the AI module 1.4.7 or below upgrade to AI module 1.4.8
• If you use the AI module 1.3.12 or below upgrade to AI module 1.3.13

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Marcus Johansson (marcus_johansson)
• Sven Decabooter (svendecabooter)
• Valery Lourie (valthebald)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-September-02Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross site scriptingAffected versions: <1.3.13 || >=1.4.0 <1.4.8CVE IDs: CVE-2026-84911Description: 

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website.

The module doesn't sufficiently sanitize for cross site scripting (XSS) when using the structured results using legacy agent setups.

This vulnerability is mitigated by the fact that an attacker must be able to invoke a prompt injection set via editorial content and the site must have been setup using AI 1.0.x and AI Agents 1.0.x branch using a uncommon configuration. Any configuration setup or updated after these minor versions are not affected.

Solution: 

Install the latest version:

• If you use the AI module 1.4.7 or below upgrade to AI module 1.4.8
• If you use the AI module 1.3.12 or below upgrade to AI module 1.3.13

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Marcus Johansson (marcus_johansson)
• Valery Lourie (valthebald)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team

Project: Advanced SearchProject machine name: advanced_searchDate: 2026-September-02Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.4.5CVE IDs: CVE-2026-84910Description: 

This module enables AJAX updates for advanced search, facet, and search result blocks.

The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content.

This vulnerability is mitigated by the fact that an attacker must know or guess a restricted block’s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions.

Solution: 

Install the latest version:

• If you use the Advanced Search module, upgrade to Advanced Search 2.4.5

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Annie Oelschlager (annieoelschlager)
• Joe Corall (joecorall)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Slick CarouselProject machine name: slickDate: 2026-August-26Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingAffected versions: <2.1.0CVE IDs: CVE-2026-81160Description: 

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons.

Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting (XSS) vulnerability.

Note: This vulnerability was fixed in 8.x-2.1 but that was not marked as a security release at the time.

Solution: 

• Only the 3.0.x branch is supported by the maintainers. Upgrade to a release on that branch.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Gaus Surahman (gausarts)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• cilefen of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Monster MenusProject machine name: monster_menusDate: 2026-August-26Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site ScriptingAffected versions: <9.5.3CVE IDs: CVE-2026-81201Description: 

This module enables you to create one or more multisites with highly granular page permissions.

The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user’s session.

This vulnerability is mitigated by the fact that an attacker must have the ability to create pages whose page title supports HTML.

Solution: 

Install the latest version:

• If you use the Monster Menus module, upgrade to monster_menus 9.5.3.

Reported By: 

• Dan Wilga (gribnif)

Fixed By: 

• Dan Wilga (gribnif)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: LDAP / Active Directory IntegrationProject machine name: ldap_authDate: 2026-August-26Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Proof/TD:AllVulnerability: Information DisclosureAffected versions: <2.2.1CVE IDs: CVE-2026-81205Description: 

This module enables users to authenticate using LDAP or Active Directory credentials.

The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to.

Solution: 

Install the latest version:

• If you use the LDAP / Active Directory Integration module, upgrade to LDAP / Active Directory Integration 2.2.1.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Harshvardhan Soni (sharsh)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Entity PDFProject machine name: entity_pdfDate: 2026-August-26Security risk: Moderately critical 13 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.1.5CVE IDs: CVE-2026-81164Description: 

The Entity PDF module can create a PDF from any entity based on any View mode.

This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view.

Solution: 

Install the latest version:

• If you use the Entity PDF module for Drupal upgrade to Entity PDF 2.1.5.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Italo Mairo (itamair)
• Wesley Sandra (weseze)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Entity APIProject machine name: entityDate: 2026-August-26Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information disclosureAffected versions: <1.8.0CVE IDs: CVE-2026-81158Description: 

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties.

The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability.

This vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module.

Solution: 

Install the latest version:

• If you use the Entity API module, upgrade to Entity API 8.x-1.8.

Reported By: 

• Douglas Groene (dgroene)
• Matt Glaman (mglaman)

Fixed By: 

• Sascha Grossenbacher (berdir)
• Klaus Purer (klausi)
• Kristiaan Van den Eynde (kristiaanvandeneynde)
• Matt Glaman (mglaman)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: DXPR Builder: The Best Editing (AI) Experience for DrupalProject machine name: dxpr_builderDate: 2026-August-26Security risk: Moderately critical 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information DisclosureAffected versions: <2.8.1CVE IDs: CVE-2026-81162Description: 

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.

The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via drupalSettings.

This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.

Solution: 

Install the latest version:

• If you use the 2.x branch of the DXPR Builder module, upgrade to DXPR Builder 2.8.1 or later.
• The 3.x branch is not affected as it proxies AI requests through the contributed AI module.

Reported By: 

• jurriaanroelofs

Fixed By: 

• jurriaanroelofs

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Disable Login PageProject machine name: disable_loginDate: 2026-August-26Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:None/II:None/E:Proof/TD:AllVulnerability: Access bypassAffected versions: <1.1.4CVE IDs: CVE-2026-16647Description: 

This module enables you to disable access to the /user/login form unless a secret key is provided.

The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared. An attacker may continue to access the login page despite the restriction having been enabled.

Solution: 

Install the latest version:

• If you use the Disable Login Page module, upgrade to Disable Login Page 1.1.4.

Reported By: 

• Brian Osborne (bkosborne)
• Jason Partyka (partyka)

Fixed By: 

• Brian Osborne (bkosborne)
• Jason Partyka (partyka)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Disable Login PageProject machine name: disable_loginDate: 2026-August-26Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.1.4CVE IDs: CVE-2026-18260Description: 

This module enables you to disable access to the /user/login form unless a secret key is provided.

The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism.

Solution: 

Install the latest version:

• If you use the Disable Login Page module, upgrade to Disable Login Page 1.1.4.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Brian Osborne (bkosborne)
• Jason Partyka (partyka)

Coordinated By: 

• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Digital Signage FrameworkProject machine name: digital_signage_frameworkDate: 2026-August-26Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.6.1CVE IDs: CVE-2026-81166Description: 

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display.

The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous visitor could read the rendered content of blocks they were not meant to see.

This vulnerability is mitigated by the fact that many block plugins perform their own access checks on the content they display, which limits what can be disclosed through this route.

Solution: 

Install the latest version:

• If you use Digital Signage Framework 2.6.x, update to 2.6.1.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Daniel Speicher (danielspeicher)
• Jürgen Haas (jurgenhaas)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Data fieldProject machine name: datafieldDate: 2026-August-26Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information disclosureAffected versions: <2.0.13CVE IDs: CVE-2026-81269Description: 

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.

The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.

Solution: 

Install the latest version:

• If you use the Data Field module, upgrade to Data Field 2.0.13

Reported By: 

• Marcus Johansson (marcus_johansson)
• Drew Webber (mcdruid) of the Drupal Security Team
• Steven Jones (steven jones)

Fixed By: 

• Joseph Olstad (joseph.olstad)
• NGUYEN Bao (lazzyvn)
• Marcus Johansson (marcus_johansson)
• Steven Jones (steven jones)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• David Stoline (dstol)
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Content Moderation NotificationsProject machine name: content_moderation_notificationsDate: 2026-August-26Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <3.9.0CVE IDs: CVE-2026-81161Description: 

The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted.

A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators.

Solution: 

Install the latest version:

• If you use Content Moderation Notifications, upgrade to version 8.x-3.9.
• Review roles to ensure only trusted roles have access to the "administer content moderation notifications" permission.

changed.

Reported By: 

• Lee Rowlands (larowlan) of the Drupal Security Team
• Luke Leber (luke.leber)

Fixed By: 

• Brian Osborne (bkosborne)
• Jonathan Hedstrom (jhedstrom)
• Luke Leber (luke.leber)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Commerce CyberSourceProject machine name: commerce_cybersourceDate: 2026-August-26Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Insufficient input validationAffected versions: <1.10.0CVE IDs: CVE-2026-81159Description: 

This module integrates Drupal Commerce with the CyberSource payment gateway.

The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't.

This issue only affects the Secure Acceptance Hosted Checkout gateway integration.

Solution: 

Install the latest version:

• If you use the Commerce CyberSource module, upgrade to Commerce CyberSource 8.x-1.10.

Reported By: 

• Brian Willows

Fixed By: 

• Adrian M. (adrianandres)
• Ryan Szrama (rszrama)
• Vitaliy Marchuk (vmarchuk)

Coordinated By: 

• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Heine Deelstra (heine) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: CAPTCHA Protected PageProject machine name: captcha_protected_pageDate: 2026-August-26Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Cookie ForgeryAffected versions: <1.0.2CVE IDs: CVE-2026-81168Description: 

This module enables site administrators to require CAPTCHA confirmation on specific pages.

The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirely.

Solution: 

Install the latest version:

• If you use the CAPTCHA Protected Page module, upgrade to CAPTCHA Protected Page 1.0.2.

Reported By: 

• lovasoa

Fixed By: 

• Carlo Miguel Agno (carlagno)
• Mark Jayson Gruta (mjgruta)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Carlo Miguel Agno (carlagno)
• Greg Knaddison (greggles) of the Drupal Security Team
• Heine Deelstra (heine) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: BlazyProject machine name: blazyDate: 2026-August-26Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <3.0.18CVE IDs: CVE-2026-81165Description: 

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode.

The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view.

The issue is mitigated by the fact that the shortcode does not expose the entire entity. Only fields that the shortcode can render are vulnerable.

Solution: 

Install the latest version:

• If you use the Blazy module for Drupal, upgrade to Blazy 3.0.18.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Gaus Surahman (gausarts)
• Drew Webber (mcdruid) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Address SuggestionDate: 2026-August-26Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.0.25CVE IDs: CVE-2026-81167Description: 

The Address Suggestion module provides address autocomplete functionality using configured address providers.

The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must be able to inject malicious content into data returned by a configured address provider, and a user must perform a search that returns the malicious suggestion.

Solution: 

Install the latest version:

• If you use the address_suggestion module, upgrade to address_suggestion 1.0.25.

Reported By: 

• Conrad Lara (cmlara)

Fixed By: 

• Conrad Lara (cmlara)
• Joseph Olstad (joseph.olstad)
• NGUYEN Bao (lazzyvn)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: ScreenshotDate: 2026-August-19Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-76759CVE-2026-76782Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By: 

• Conrad Lara (cmlara)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Heine Deelstra (heine) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team