Drupal Security

Project: Authenticator Login Plus (2FA)Project machine name: auth_login_plusDate: 2026-October-07Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Improper authenticationAffected versions: <1.0.1CVE IDs: CVE-2026-107261Description: 

This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide.

The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.

Solution: 

Install the latest version:

• If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1.

After upgrading, users who previously disabled 2FA will be asked to set it up again at their next login. Administrators can also re-enable 2FA for a user from the admin overview so the user keeps their existing authenticator.

Reported By: 

• mouhamed rayen mansouri (w0nd3r)

Fixed By: 

• mugesh.s

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Linked FieldProject machine name: linked_fieldDate: 2026-October-07Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Server-side template injectionAffected versions: <1.8.0CVE IDs: CVE-2026-107259Description: 

This module enables you to link the output of a field to a URL or to the value of another field.

The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site configuration values, which may include sensitive information such as API keys or credentials.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content in a field that has Linked Field enabled in its display settings.

Solution: 

Install the latest version:

• If you use the Linked Field module for Drupal 8.x or later, update to Linked Field 8.x-1.8

Reported By: 

• Maksim Hayder (tr_jan)

Fixed By: 

• Vitaliy Bogomazyuk (vitaliyb98)
• Yannick (yannickoo)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Inline Entity Form DialogProject machine name: inline_entity_form_dialogDate: 2026-October-07Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.0.6CVE IDs: CVE-2026-107258Description: 

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields.

This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".

Solution: 

Install the latest version:

• If you use the Inline Entity Form Dialog module for Drupal 11, upgrade to Inline Entity Form Dialog 1.0.6

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Marcus Johansson (marcus_johansson)
• Zeeshaan khann (zeeshan_khan)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: ActstreamProject machine name: actstreamDate: 2026-October-07Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.0.1 || >=2.1.0 <2.1.1CVE IDs: CVE-2026-107257Description: 

Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities.

The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability.

Solution: 

Install the latest version:

• If you use Actstream 2.1.x, upgrade to Actstream 2.1.1.
• If you use Actstream 2.0.x, upgrade to Actstream 2.0.1.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Reva Gomes (revagomes)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: Authenticator Login Plus (2FA)Project machine name: auth_login_plusDate: 2026-October-07Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Improper authenticationAffected versions: <1.0.1CVE IDs: CVE-2026-107254Description: 

This module provides TOTP-based two-factor authentication (2FA) for Drupal.

The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link.

This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a victim's account.

Solution: 

Install the latest version:

• If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1.

After upgrading, users with 2FA enabled will be asked for their verification code after using a one-time login link.

Reported By: 

• mouhamed rayen mansouri (w0nd3r)

Fixed By: 

• mugesh.s

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Orphans MediaProject machine name: orphans_mediaDate: 2026-October-07Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-107253Description: 

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: MathJax: LaTeX for DrupalProject machine name: mathjaxDate: 2026-October-07Security risk: Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross site scriptingAffected versions: <4.1.2CVE IDs: CVE-2026-107252Description: 

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet.

The module ships with library configurations that do not escape JavaScript within the TeX it formats.

Notice: This release updates CDN URLs where possible and adds a system status warning for unsafe configurations. If you are unable to upgrade immediately, you can modify either the CDN URL or the custom MathJax JavaScript configuration according to the instructions in MathJax Safe-mode.

Solution: 

Install the latest version:

• If you use the MathJax module, upgrade to MathJax 4.1.2
• Check the Drupal status report for MathJax module warnings. If "safe mode is not enabled" appears, the MathJax configuration couldn't be automatically updated. Read the information above to manually fix the configuration.

Reported By: 

• cilefen (cilefen) of the Drupal Security Team

Fixed By: 

• bchin
• cilefen (cilefen) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Entity Reference Manager (Merge entities)Project machine name: entity_reference_managerDate: 2026-October-07Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.0.3CVE IDs: CVE-2026-107251Description: 

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system.

The module does not sufficiently restrict access to all entity management operations. Users who can view content can access the entity merge functionality and delete arbitrary nodes, taxonomy terms, or media entities.

Solution: 

Install the latest version:

• If you use the Entity Reference Manager module, upgrade to Entity Reference Manager 1.0.3

Reported By: 

• Joshua Sedler (grevil)

Fixed By: 

• Cristiano Demari (cristianodemari)
• Joshua Sedler (grevil)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: ECA HelperProject machine name: eca_helperDate: 2026-October-07Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-107250Description: 

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By: 

• Luke Leber (luke.leber)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Block AJAXProject machine name: block_ajaxDate: 2026-October-07Security risk: Highly critical 20 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: PHP object injectionAffected versions: <3.0.2CVE IDs: CVE-2026-107249Description: 

The Block AJAX module enables you to load blocks asynchronously via Ajax.

The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution.

The vulnerability is mitigated by the fact that it only affects sites that have Layout Builder enabled (or another block plugin that handles the data this module passes to it in a potentially unsafe way).

Please see the release notes for details of potentially breaking changes.

Solution: 

Install the latest version:

• If you use the "block_ajax" module, upgrade to block_ajax 3.0.2

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Julian Pustkuchen (anybody)
• Joshua Sedler (grevil)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team

Project: Diba carousel sliderProject machine name: diba_carouselDate: 2026-September-23Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross Site Scripting (XSS)Affected versions: <3.0.2CVE IDs: CVE-2026-96382Description: 

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration.

When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms.

This vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the "Allow HTML description" option.

Solution: 

Upgrade to the latest version:

• If you are using Diba carousel slider 3.1.x, upgrade to Diba carousel slider 3.1.0.
• If you are using Diba carousel slider 3.0.x, upgrade to Diba carousel slider 3.0.2.

If you are unable to upgrade immediately, disable the "Allow HTML description" option in affected carousel blocks until the update can be applied.

Reported By: 

• Kalle Kipinä (kekkis)

Fixed By: 

• Oriol Roselló Castells (oriol_e9g)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Smart ContentProject machine name: smart_contentDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <3.2.1CVE IDs: CVE-2026-96386Description: 

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.

The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.

This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.

Solution: 

Install the latest version:

• Upgrade to Smart Content 3.2.1.

Reported By: 

• Tin Nguyen Huu (s4m0y3d)

Fixed By: 

• Michael Lander (michaellander)
• Tin Nguyen Huu (s4m0y3d)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: CSS Usage AnalyzerProject machine name: css_usage_analyzerDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Improper access controlAffected versions: >=1.0.0 <1.0.2CVE IDs: CVE-2026-96380Description: 

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics.

This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions.

Solution: 

Install the latest version:

• Upgrade to CSS Usage Analyzer 1.0.2.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Marcus Johansson (marcus_johansson)
• Zeeshaan khann (zeeshan_khan)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Combined image styleProject machine name: combined_image_styleDate: 2026-September-23Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Improper access controlAffected versions: <1.0.7CVE IDs: CVE-2026-96377Description: 

This module enables you to combine multiple image styles into a single image derivative.

The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token, potentially leading to a denial of service.

Sites are affected simply by having the module installed, even when no combined image styles are configured or in use.

This vulnerability is mitigated by the fact that only public files can be targeted, and derivatives of private files are still protected by core's token check.

Solution: 

Install the latest version:

• If you use the Combined image style module, upgrade to Combined image style 1.0.7.

Reported By: 

• Sven Decabooter (svendecabooter)

Fixed By: 

• Sven Decabooter (svendecabooter)
• Swan Kalata (akalata) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI CKEditorProject machine name: ai_ckeditorDate: 2026-September-23Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Code execution via Twig templatesAffected versions: <1.4.3CVE IDs: CVE-2026-96392Description: 

This module enables you to use AI to fill in or replace text in CKEditor.

The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data.

Solution: 

Install the latest version:

• If you use the AI CKEditor module, upgrade to AI CKEditor 1.4.3.

Reported By: 

• Stef Rouschop (stefro)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Marcus Johansson (marcus_johansson)
• Stef Rouschop (stefro)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Webform RESTProject machine name: webform_restDate: 2026-September-23Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <4.2.1CVE IDs: CVE-2026-96391Description: 

This module enables you to retrieve and submit webforms via REST.

The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.

Solution: 

Install the latest version:

• Upgrade to Webform REST 4.2.1. The 4.1.x branch is no longer supported.

Reported By: 

• Lauri (laurii)

Fixed By: 

• Adam Bramley (acbramley)
• Miguel Ferreira (miguelpamferreira)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Editoria11y Accessibility CheckerProject machine name: editoria11yDate: 2026-September-23Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.2.23 || >=3.0.0 <3.0.9CVE IDs: CVE-2026-96390Description: 

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API.

The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass.

Solution: 

If you use the Editoria11y module, update the module and review permissions.

• If you use the Editoria11y module version 2.2.x, upgrade to editoria11y 2.2.23.
• If you use the Editoria11y module version 3.0.x, upgrade to editoria11y 3.0.9.

Review permissions: Make sure anonymous or untrusted authenticated users have not been given permission to use the checker. The permission is labeled as:

• View Editoria11y checker up to and including 2.2.22/3.0.8, and
• Run Editoria11y checker and report results with 2.2.23/3.0.9.

Reported By: 

• Maksim Hayder (tr_jan)

Fixed By: 

• Brian Osborne (bkosborne)
• John Jameson (itmaybejj)
• Jason Partyka (partyka)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Tawk.to - Live chat applicationProject machine name: tawk_toDate: 2026-September-23Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryAffected versions: <3.0.4CVE IDs: CVE-2026-96388Description: 

This module provides integration of the tawk.to live chat for Drupal sites.

The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

Solution: 

Install the latest version:

• Upgrade to tawk.to 3.0.4.

After updating, clear the Drupal cache.

Reported By: 

• Tin Nguyen Huu (s4m0y3d)

Fixed By: 

• Andriy Khomych (andriy khomych)
• Tin Nguyen Huu (s4m0y3d)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Stop administrator loginProject machine name: stop_adminDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: >=1.0 <1.6CVE IDs: CVE-2026-96387Description: 

This module enables sites to block access for the administrative user account (user 1) or users with the administrator role.

The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be able to authenticate through certain alternative authentication methods.

This vulnerability is mitigated by the fact that an attacker must possess valid credentials for a user with the administrator role, and must authenticate using a less commonly used authentication mechanism.

Solution: 

Install the latest version:

• If you use the Stop Administrator Login module, upgrade to Stop Administrator Login 8.x-1.6

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: REST & JSON API Authentication for DrupalProject machine name: rest_api_authenticationDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <3.2.0CVE IDs: CVE-2026-96385Description: 

This module enables you to add an extra authentication layer to the API.

The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability.

Solution: 

Install the latest version:

• Upgrade to REST & JSON API Authentication 3.2.0.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• purva_shende

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Heine Deelstra (heine) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team