Drupal Security

Project: Link content parserDate: 2026-August-19Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-76758Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Coordinated By: 

• Heine Deelstra (heine) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Gammu SMS DaemonDate: 2026-August-19Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-76755CVE-2026-76756CVE-2026-76757Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Heine Deelstra (heine) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Quick TabsDate: 2026-August-12Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <4.3.1CVE IDs: CVE-2026-73477Description: 

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance.

The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and performed no access check for reusable custom blocks. Content that should have been denied was therefore rendered — for example, an unpublished node or unpublished reusable custom block could be shown to users without permission to view it.

The access bypass is mitigated by the fact that affected content is selected by a user with the “administer quicktabs” permission when the tab is configured, so an attacker cannot choose which content is exposed.

Solution: 

Install the latest version:

• If you use the Quick Tabs module for Drupal, upgrade to Quick Tabs 4.3.1

Reported By: 

• Joël Pittet (joelpittet)

Fixed By: 

• Joël Pittet (joelpittet)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: External AuthenticationDate: 2026-August-12Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <2.0.13CVE IDs: CVE-2026-73476Description: 

This module enables you to authenticate Drupal users against external identity providers.

The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations.

This vulnerability is minimally mitigated by the fact that it affects only sites using impacted MySQL or MariaDB collation settings for the module’s authentication mapping storage. Affected collations are quite common so all sites are encouraged to upgrade.

Solution: 

Install the latest version:

• If you use the externalauth module for Drupal, upgrade to 2.0.13

Reported By: 

• 晉宇 林 (whale120)

Fixed By: 

• Sven Decabooter (svendecabooter)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Entity Share WebsubDate: 2026-August-12Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Server-side request forgery (SSRF)Affected versions: <1.1.2CVE IDs: CVE-2026-73474Description: 

This module enables you to share content between sites in a hub - subscriber model.

Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks.

Solution: 

Install the latest version:

• If you use the Entity Share Websub module for Drupal 9.x or 10.x, upgrade to Entity Share Websub 1.1.2

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Shawn Duncan (fathershawn)
• Jeffrey S. Mattson (jeffreysmattson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: DiffDate: 2026-August-12Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.0.1 || >=2.1.0 <2.1.1CVE IDs: CVE-2026-73478Description: 

This module enables you to view the differences between revisions on any entity type.

The module doesn't sufficiently restrict access to non-node entity revision diffs.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity.

Solution: 

Install the latest version:

• If you use the Diff module, upgrade to Diff 2.1.1 or Diff 2.0.1

Reported By: 

• Alexei Rayu (alexrayu)

Fixed By: 

• Adam Bramley (acbramley)
• Derek Wright (dww)
• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team

Project: Commerce PayPalDate: 2026-August-12Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: < 1.12.0 || >= 2.0.0 < 2.1.3CVE IDs: CVE-2026-73475Description: 

This module enables you to pay for Commerce transactions using Paypal.

The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment.

This vulnerability only affects sites using the Payflow Link payment gateway.

Solution: 

• If you use the Commerce Paypal module for Drupal, upgrade to Commerce Paypal 2.1.3 or Commerce Paypal 8.x-1.12

Reported By: 

• Kimberley Massey (kimberleycgm)

Fixed By: 

• Jonathan Sacksick (jsacksick)
• Kimberley Massey (kimberleycgm)
• Ryan Szrama (rszrama)
• Tom Ashe (tomtech)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Benji Fisher (benjifisher) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Entity BrowserDate: 2026-August-05Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross site scriptingAffected versions: <2.16.0CVE IDs: CVE-2026-18986Description: 

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.

The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.

Solution: 

Install the latest version:

• If you use the Entity Browser module, upgrade to Entity Browser 8.x-2.16

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Julian Pustkuchen (anybody)
• Sascha Grossenbacher (berdir)
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Edit in-place fieldDate: 2026-August-05Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.1.1CVE IDs: CVE-2026-18985Description: 

This module provides formatters to allow in-place editing in a View or other display (full content, teaser...).

The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission".

Solution: 

Install the latest version:

• If you use the Edit in-place field module for Drupal, upgrade to 2.1.1

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Bálint Nagy (nagy.balint)

Coordinated By: 

• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: Powerful SurveysDate: 2026-July-29Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-18261Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: Disable Login PageDate: 2026-July-29Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-18260Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: Token Content AccessDate: 2026-July-29Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <3.1.2CVE IDs: CVE-2026-18259Description: 

The Token Content Access module enables site administrators to provide access to content using access tokens.

The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access restrictions for content protected by this module.

This vulnerability is mitigated by the fact that an attacker must know or discover a URL for content protected by Token Content Access, and exploiting the issue requires measuring timing differences in token comparison responses.

Solution: 

Install the latest version:

• If you use the Token Content Access module for Drupal 10.x/11.x, upgrade to Token Content Access 3.1.2

Reported By: 

• Robin (robincs)

Fixed By: 

• Kyrylo Loboda (lobodakyrylo)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: Development EnvironmentDate: 2026-July-22Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-15088Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: PhotoSwipe - Responsive JavaScript Modal Image GalleryDate: 2026-July-22Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <3.2.0CVE IDs: CVE-2026-16645Description: 

The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters.

The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery display formatter, in versions < 3.0.4 (Drupal 8) or < 3.2.0 (Drupal 9 / Drupal 10).

This vulnerability is mitigated by the fact that it only affects sites limiting access to the images shown in photoswipe (the most common use case for photoswipe lightboxes public images).

Solution: 

Drupal 8 compatible version (3.0x.): Update to version 3.0.4 of the Photoswipe module.
Drupal 9 / Drupal 10 compatible version (3.1.x / 3.2.x): Ensure you're using version 3.2.0 or higher. 3.1.x is deprecated and should not be used anymore.

Reported By: 

• Aleksi Peebles (aleksip)

Fixed By: 

• Aleksi Peebles (aleksip)
• Julian Pustkuchen (anybody)
• Joshua Sedler (grevil)

Coordinated By: 

• cilefen (cilefen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Webform RESTDate: 2026-July-22Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <4.1.0CVE IDs: CVE-2026-16644Description: 

This module enables you to retrieve and submit webform submissions via REST endpoints.

The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions.

This vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource.

This advisory only affects already-unsupported versions 4.0.3 and earlier.

Solution: 

Install the latest version:

• If you use the Webform Rest module for Drupal 8.x, upgrade to Webform Rest 4.1.0
• Version 4.2.0 already has the fix included so no action needed if you use that version

Reported By: 

• Giuseppe (giuseppe87)

Fixed By: 

• Dan Chadwick (danchadwick)
• Giuseppe (giuseppe87)
• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)
• Nelson Alves (nsalves)

Coordinated By: 

• Anna Kalata (akalata) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Michael Hess (mlhess) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Date: 2026-July-22Description: 

QA Accounts enables you to login to a Drupal site using a well known username/password combination. When 1.0 was released, it also was marked for security coverage. The module prioritizes ease of use rather than security and is only intended to be used on sites that are not accessible on the internet (e.g. behind firewall or other protection). The maintainers are choosing to remove security coverage.

Solution: 

Ensure qa_accounts is not enabled on any publicly available site.

Reported By: 

• Jordan Barnes (j-barnes)

Fixed By: 

• Jakob P (japerry)

Project: Lunr exposed filtersDate: 2026-July-22Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Unsupported Affected versions: *CVE IDs: CVE-2026-16643Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: Email Login OTPDate: 2026-July-22Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-16642Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Commerce ElavonDate: 2026-July-22Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-16641Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: PanKMDate: 2026-July-22Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-16646Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...