Drupal Security

Project: Commerce CoreProject machine name: commerceDate: 2026-October-28Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <2.41.0 || >=3.0.0 <3.3.13CVE IDs: CVE-2026-118541Description: 

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them.

The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is only allowed to manage their own promotions can delete or change coupons that belong to other promotions.

This vulnerability is mitigated by the fact that the site must accept writes through JSON:API or REST, which is not enabled by default.

Solution: 

Install the latest version:

• If you use Commerce Core 3.x, upgrade to Commerce Core 3.3.13.
• If you use Commerce Core 8.x-2.x, upgrade to Commerce Core 8.x-2.41.

Reported By: 

• Marcus Johansson (Marcus_Johansson)

Fixed By: 

• Jonathan Sacksick (jsacksick)
• Jakub Piasecki (zaporylie)
• Tom Ashe (TomTech)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce CoreProject machine name: commerceDate: 2026-October-28Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information disclosureAffected versions: <2.41 || >=3.0.0 <3.2.0CVE IDs: CVE-2026-118540Description: 

This module enables you to sell goods and services to customers through a shopping cart and checkout form.

When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission.

This vulnerability is mitigated by only affecting sites with published products and unpublished product variations.

Solution: 

Install the latest version:

• If you use Commerce Core 3.2.x or lower, upgrade to Commerce Core 3.3.13.
• If you use Commerce Core 8.x upgrade to Commerce Core 8.x-2.41.

Commerce Core 3.3.x is not affected by this vulnerability.

Reported By: 

• Matt Glaman (mglaman)

Fixed By: 

• Julian Pustkuchen (anybody)
• Jonathan Sacksick (jsacksick)
• Matt Glaman (mglaman)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Mori Sugimoto (dokumori) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce CoreProject machine name: commerceDate: 2026-October-28Security risk: Highly critical 21 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:AllVulnerability: Access bypassAffected versions: <2.41 || >=3.0.0 <3.3.13CVE IDs: CVE-2026-118539Description: 

This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs.

The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.

This vulnerability is being actively exploited in the wild.

Solution: 

Install the latest version:

• If you use version 3.x, upgrade to Commerce Core 3.3.13.
• If you use an earlier version, upgrade to Commerce Core 8.x-2.41.

Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.

Reported By: 

• Dan Puccetti (dpuccetti)
• Marcus Johansson (marcus_johansson)
• Robert Snyder (rsnyd)

Fixed By: 

• Jonathan Sacksick (jsacksick)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
• Ryan Szrama (rszrama)
• Tom Ashe (tomtech)
• Jakub Piasecki (zaporylie)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Vijay Mani (vijaycs85) provisional member of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Monster MenusProject machine name: monster_menusDate: 2026-October-21Security risk: Critical 16 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: PHP object injectionAffected versions: <9.5.6CVE IDs: CVE-2026-114573Description: 

This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds.

When the input of the node creation form is processed, it makes use of PHP's unserialize function. This introduces a PHP object injection vulnerability.

This vulnerability is mitigated by the fact that the RSS Page submodule must be enabled and an attacker must have a role with the permission "RSS Feed: Create new content".

Solution: 

Install the latest version:

• If you use the monster_menus module, upgrade to monster_menus 9.5.6

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Dan Wilga (gribnif)

Coordinated By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Project: Rabbit HoleProject machine name: rabbit_holeDate: 2026-October-21Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access BypassAffected versions: <1.3.0CVE IDs: CVE-2026-114571Description: 

Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the visitor to another URL.

The module has two vulnerabilities.

Rabbit Hole behavior can be skipped with a specific query parameter. In these cases, an affected entity made Rabbit Hole treat the request as an error page and do nothing. An anonymous visitor could view content a site had configured to return an access denied or not found response, or avoid a configured redirect.

The per-entity settings are stored in fields that the module adds to supported entity types. The module only checks the "Administer Rabbit Hole settings for <entity type>" permission when it decides whether to show those settings on the entity edit form. The fields themselves carry no access control, so Drupal's default field access applies and anyone who can edit the entity can also edit these fields.

The first vulnerability affects every site that relies on Rabbit Hole to deny access to or hide entities. The second is mitigated by the fact that an attacker must have a role with permission to edit the affected entities, and the site must expose a write path that bypasses the entity form, such as JSON:API with writes enabled, REST, or Views Bulk Operations.

Solution: 

Install the latest version:

• If you use the rabbit_hole module, upgrade to rabbit_hole 8.x-1.3

Sites that cannot update immediately can reduce exposure by disabling REST write methods and bulk operations for roles that do not hold the administer permission, or by removing the "Edit any content" permissions from untrusted roles.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Jakob P (japerry)
• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team

Coordinated By: 

• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI File to TextProject machine name: ai_file_to_textDate: 2026-October-21Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.0.1CVE IDs: CVE-2026-114554Description: 

The AI File to Text module extracts text from uploaded documents, including
Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool.

The module does not sufficiently check whether the current user is permitted
to view a file before extracting its contents. This allows the contents of files the user could not otherwise download, including files held in the private file system,
to be disclosed.

This vulnerability is mitigated by the fact that an attacker must have a role
with permission to invoke AI tools, for example through an agent or the AI API
Explorer.

Solution: 

Install the latest version:

• If you use the AI File to Text module, upgrade to AI File to Text 1.0.1

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Ahmad Khader (ahmad khader)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Data fieldProject machine name: datafieldDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: <2.0.14CVE IDs: CVE-2026-114555Description: 

Data Field allows you to create custom fields with multiple values under the default table form.

The file_uri formatter does not properly escape filenames when rendering links to uploaded files.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.

Solution: 

Install the latest version:

• If you use the Data Field module, upgrade to Data Field 2.0.14

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• Joseph Olstad (joseph.olstad)
• NGUYEN Bao (lazzyvn)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Domain Login RestrictProject machine name: domain_login_restrictDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <1.5.0CVE IDs: CVE-2026-114572Description: 

This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to them.

The module doesn't sufficiently enforce these restrictions when a user logs in by a method other than the standard login form.

This vulnerability is mitigated by the fact that an attacker must have a valid user account on the site, and the "Enable restriction" setting must be enabled on the Domain settings page. Users with the "Login to any domain" permission are not affected by the restriction.

Solution: 

Install the latest version:

• If you use Domain Login Restrict, upgrade to Domain Login Restrict 8.x-1.5

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Sunil Pawar (sunilpawar)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: ShieldProject machine name: shieldDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.9.0CVE IDs: CVE-2026-107256Description: 

The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled or indexed by anonymous visitors.

The module doesn't sufficiently limit the number of authentication attempts it will evaluate under the scenario where an anonymous visitor repeatedly submits basic authentication credentials.

This vulnerability is mitigated by the fact that the configured Shield credentials must be guessable — a long, randomly generated password is not practically brute forceable — and by the fact that Shield is intended as a supplementary barrier in front of a site rather than the site's user access control systems.

Solution: 

Install the latest version:

• If you use the shield module, upgrade to Shield 8.x-1.9

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Merlin Axel Rutz (geek-merlin)
• Jakob P (japerry)
• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
• Ra Mänd (ram4nd) provisional member of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: ImageAPI Optimize WebPProject machine name: imageapi_optimize_webpDate: 2026-October-21Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <2.1.2CVE IDs: CVE-2026-114548Description: 

This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them.

The module serves WebP image derivative responses with the HTTP header Cache-Control: public for all file schemes other than the private file system, including the temporary file system and access-controlled custom schemes. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN.

This vulnerability is mitigated by the fact that it only affects sites that serve image derivatives from a custom or temporary file scheme with access control, behind a shared cache that honors the Cache-Control header. Access checks are still enforced on requests that reach the site itself. An attacker would also need to know the path of a previously requested file still in cache.

This is the same vulnerability class fixed in Drupal core by SA-CORE-2025-008 and SA-CORE-2026-010; the module's controller override reintroduced the behavior.

Solution: 

Install the latest version:

• If you use the ImageAPI Optimize WebP module 2.1.x, upgrade to ImageAPI Optimize WebP 2.1.2
• ImageAPI Optimize WebP 2.0.x only supports Drupal 10.1 and 10.2, which are end-of-life. It will not receive a security update and is no longer supported.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Michael Lander (michaellander)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: TinyPNGProject machine name: tinypngDate: 2026-October-21Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <2.0.2CVE IDs: CVE-2026-114547Description: 

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files.

The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.

This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

Solution: 

Install the latest version:

• If you use TinyPNG 2.0.x, upgrade to TinyPNG 2.0.2

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• István Csáki (csakiistvan)
• Vince Tikász (tikaszvince)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Media Alias DisplayProject machine name: media_alias_displayDate: 2026-October-21Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <2.1.2 || >=3.0.0 <3.0.2CVE IDs: CVE-2026-114546Description: 

This module allows for direct viewing of a file with the URL alias.

In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.

This vulnerability is mitigated by the following:

• Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.
• An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached.

Solution: 

Install the latest version:

• If you use the media_alias_display module 3.0.x, upgrade to 3.0.2
• If you use the media_alias_display module 2.1.x, upgrade to 2.1.2

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Stephen Mustgrave (smustgrave)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Fullcalendar ViewProject machine name: fullcalendar_viewDate: 2026-October-21Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <5.2.6CVE IDs: CVE-2026-114545Description: 

This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library.

This module has an access bypass vulnerability which allows to update entity fields without checking field-level access.

The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.

Solution: 

Install the latest version:

• If you use the Fullcalendar View module, upgrade to Fullcalendar View 5.2.6

Reported By: 

• Maksim Hayder (tr_jan)

Fixed By: 

• Mingsong (mingsong), provisional member of the Drupal Security Team

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team

Project: Media Bulk UploadProject machine name: media_bulk_uploadDate: 2026-October-21Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <3.0.6CVE IDs: CVE-2026-114544Description: 

This module enables users to upload files and create media items in bulk.

The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "bulk upload form".

Solution: 

Install the latest version:

• If you use Media Bulk Upload module, upgrade to Media Bulk Upload 3.0.6

Reported By: 

• Stuart Rowlands (stooit)

Fixed By: 

• Jen M (jannakha)
• Sjoerd Wenker (sjerdo)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Simple OAuth (OAuth2) & OpenID ConnectProject machine name: simple_oauthDate: 2026-October-21Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: >=6.1.0 <6.1.3CVE IDs: CVE-2026-114542Description: 

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.

Since version 6.1.0, the module could cache a token's permissions in a way that let them be reused for another user's token with the same scopes. A user could gain permissions they do not have, including administrative access.

This vulnerability is mitigated by the fact that an attacker needs an OAuth2 token, and cannot trigger the issue themselves: a more privileged user's token with the same scopes must be used first. User 1 is not affected unless security.enable_super_user is set to false.

Solution: 

Install the latest version:

• If you use the "Simple OAuth (OAuth2) & OpenID Connect >= 6.1.0", upgrade to Simple OAuth (OAuth2) & OpenID Connect 6.1.3

Reported By: 

• Jonathan Shaw (jonathanshaw)
• Alexander Varwijk (kingdutch)
• Mingsong (mingsong)
• Stephan Huber (stmh)
• Trevor Bradley (trevorbradley)

Fixed By: 

• Bojan Bogdanovic (bojan_dev)
• Alexander Varwijk (kingdutch)
• Mingsong (mingsong), provisional member of the Drupal Security Team
• Trevor Bradley (trevorbradley)
• Jonathan Shaw (jonathanshaw)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Benji Fisher (benjifisher) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Frontend EditingProject machine name: frontend_editingDate: 2026-October-21Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.9.3CVE IDs: CVE-2026-114553Description: 

This module enables editors to edit content, including paragraphs, directly on the rendered page.

The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "access frontend editing", "add paragraphs"/"edit paragraphs"/"delete paragraphs" and also have access to update the parent entity the field belongs to.

Solution: 

Install the latest version:

• If you use the frontend_editing module, upgrade to frontend_editing 1.9.3

Reported By: 

• Artem Dmitriiev (a.dmitriiev)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Bruno Bruno (bbruno)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Frontend EditingProject machine name: frontend_editingDate: 2026-October-21Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross-Site Request Forgery (CSRF)Affected versions: <1.9.3CVE IDs: CVE-2026-114541Description: 

This module enables editors to edit content, including paragraphs, directly on the rendered page.

The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery (CSRF). An attacker could trick an editor into visiting a crafted link, which deletes or reorders paragraphs on a node using the editor's permissions.

This vulnerability is mitigated by the fact that the victim must be logged in with permission to edit the content and to delete or move paragraphs.

Solution: 

Install the latest version:

• If you use Frontend Editing, upgrade to Frontend Editing 1.9.3.

Reported By: 

• Artem Dmitriiev (a.dmitriiev)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Norman Kämper-Leymann (norman.lol)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Simple User ManagementProject machine name: simple_user_managementDate: 2026-October-21Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.11.0CVE IDs: CVE-2026-114543Description: 

This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation.

The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect user 1 from being deactivated or deleted.

This vulnerability is mitigated by the fact that an attacker must have a role with one of the module's additional action permissions.

Solution: 

Install the latest version:

• If you use the Simple User Management module, upgrade to Simple User Management 8.x-1.11

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Scott Euser (scott_euser)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: DomainProject machine name: domainDate: 2026-October-21Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: >=3.0.0 <3.0.2CVE IDs: CVE-2026-114540Description: 

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type.

The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled.

This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain.

Solution: 

Install the latest version:

• If you use the Domain 3.0.x, upgrade to Domain 3.0.2

The 2.0.x branch of the module is not affected by this vulnerability.

Reported By: 

• Frank Mably (mably)

Fixed By: 

• Frank Mably (mably)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team

Project: DocCheck BasicProject machine name: doccheck_basicDate: 2026-October-21Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2026-114539Description: 

This module allows healthcare professionals to log in to a shared account on the Drupal website using their DocCheck credentials.

The module doesn't sufficiently verify the authentication data with DocCheck API in some cases.

Solution: 

Install the latest version:

• If you use the doccheck_basic module, upgrade to Doccheck_Basic 2.2.1

Reported By: 

• Rodel Duterte (rduterte)

Fixed By: 

• sleitner

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team