Drupal Security

Project: Search API AutocompleteDate: 2026-July-22Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site ScriptingAffected versions: <1.12.0CVE IDs: CVE-2026-16640Description: 

This module enables you to add autocomplete suggestions for search forms created with the Search API module.

The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that the web server must be configured to display warning messages to users.

Solution: 

Install the latest version:

• If you use the Search API Autocomplete module, upgrade to Search API Autocomplete 8.x-1.12

Another option for sites unable to update is to set display_errors: off in php.ini (or similar settings) to disable the exploit.

Reported By: 

• Elar Lang (elarlang)

Fixed By: 

• Thomas Seiber (drunken monkey)
• Elar Lang (elarlang)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Internationalization Single Sign-OnDate: 2026-July-22Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.8.0CVE IDs: CVE-2026-16639Description: 

In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain.

The module doesn't sufficiently validate a short-lived token, allowing an attacker to bypass access control and authenticate as a victim user.

This vulnerability is mitigated by the fact that an attacker must appear to originate from the same client IP as the victim.

Solution: 

Install the latest version:

• If you use the Internationalization Single Sign-On module upgrade to i18n_sso 8.x-1.8

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Florent Torregrosa (grimreaper)
• Drew Webber (mcdruid) of the Drupal Security Team

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Media FoldersDate: 2026-July-22Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: <1.0.8CVE IDs: CVE-2026-16638Description: 

This module provides a better UI for managing and selecting Media entities in a folder structure.

The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit media items or folders.

Solution: 

Install the latest version:

• If you use the Media Folders module, upgrade to Media Folder 1.0.8

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• João Mauricio (jmauricio)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team