Drupal Security

Project: SAML SSO - Service Provider Project machine name: miniorange_samlDate: 2026-September-09Security risk: Critical 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Improper access controlAffected versions: <3.2.0CVE IDs: CVE-2026-87943Description: 

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The miniorange_saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow unauthorized users to access functionality or modify configuration values that should only be available to privileged users.

Solution: 

Install the latest version:

• Upgrade to SAML SSO - Service Provider 3.2.0.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Roushan Kumar Singh (roushan59227)
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: SafeDeleteProject machine name: safedeleteDate: 2026-September-09Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <1.0.88CVE IDs: CVE-2026-87942Description: 

This module enables you to manage content deletion and provides reports for identifying orphaned content.

The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability (XSS).

This vulnerability is mitigated by the fact that an attacker must have permission to create content of a content type configured for the orphaned nodes report.

Solution: 

Install the latest version:

• If you use the Safe Delete module, upgrade to Safe Delete 1.0.88.

Reported By: 

• Lee Rowlands (larowlan) of the Drupal Security Team

Fixed By: 

• Joseph Olstad (joseph.olstad)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Scott Morrison (scottm316)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: PatreonProject machine name: patreonDate: 2026-September-09Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedCVE IDs: CVE-2026-87941Description: 

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By: 

• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: Key authProject machine name: key_authDate: 2026-September-09Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <2.2.4CVE IDs: CVE-2026-87940Description: 

This module enables you to add key-based authentication on a per-user
basis.

The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.

This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled.

Solution: 

Install the latest version:

• If you use the Key Auth module, upgrade to Key auth 2.2.4.

Reported By: 

• Utkarsh Choudhary (sisyphus_ut)

Fixed By: 

• Utkarsh Choudhary (sisyphus_ut)
• solideogloria

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: Feed BlockProject machine name: feed_blockDate: 2026-September-09Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <2.0.2 || >=3.0.0 <3.0.2CVE IDs: CVE-2026-87939Description: 

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed.

The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

• If you use the 3.x branch, upgrade to Feed Block 3.0.2.
• If you use the 2.x branch, upgrade to Feed Block 2.0.2.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Mark Fullmer (mark_fullmer)
• mmarler

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: CSP logProject machine name: csp_logDate: 2026-September-09Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:Some/E:Theoretical/TD:AllVulnerability: SQL InjectionAffected versions: <1.0.2CVE IDs: CVE-2026-87938Description: 

The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers.

The module did not sufficiently sanitize user-supplied values used in database queries, resulting in an SQL injection vulnerability.

This vulnerability is mitigated by the fact that an attacker needs access to an account with the Access CSP reports permission to exploit the SQL Injection.

Solution: 

Install the latest version:

• If you use the CSP Log module, upgrade to CSP Log 1.0.2.

Reported By: 

• eduardo morales alberti

Fixed By: 

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: Central Authentication System (CAS) ServerProject machine name: cas_serverDate: 2026-September-09Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Open redirectAffected versions: <2.0.4 || >=2.1.0 <2.1.3CVE IDs: CVE-2026-87937Description: 

This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your database the primary location for other systems to use for authentication in a SSO environment.

The module doesn't sufficiently check the service URL used to redirect the user during logout, leading to an open redirect.

This vulnerability is mitigated by the fact that an attacker must convince a user to click a specially crafted link. The vulnerability cannot be exploited without user interaction and does not allow an attacker to directly compromise the CAS server or bypass authentication.

Solution: 

Install the latest version of Central Authentication System (CAS) Server module:

• If you use the 2.0.x branch, upgrade to CAS Server 2.0.4.
• If you use the 2.1.x branch, upgrade to CAS Server 2.1.3

Reported By: 

• Kalle Kipinä (kekkis)

Fixed By: 

• Ted Cooper (elc)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: amazee.ai Private AI ProviderProject machine name: ai_provider_amazeeioDate: 2026-September-09Security risk: Critical 17 ∕ 25 AC:Complex/A:None/CI:All/II:Some/E:Proof/TD:DefaultVulnerability: SQL injectionAffected versions: <1.3.7 || >=1.4.0 <1.4.3CVE IDs: CVE-2026-87936Description: 

Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits.

This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search.

The module doesn't sufficiently sanitize filter values before using them to build SQL queries in its Postgres/pgvector backend, allowing SQL injection.

This vulnerability is mitigated by the fact that a site must be using the module's Postgres/pgvector vector database backend for a Search API AI Search index, and must expose one of that index's non-string fields as a filter (for example, through a View) that is reachable by the attacker.

Solution: 

Install the latest version:

• If you use the amazee.ai AI Provider module for Drupal 1.4.x, upgrade to ai_provider_amazeeio 1.4.3.
• If you use the 1.3.x branch, upgrade to ai_provider_amazeeio 1.3.7.

Reported By: 

• Matan Kotick (matank001)

Fixed By: 

• Dan Lemon (dan2k3k4)
• Dimitris Spachos (dspachos)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• Swan Kalata (akalata) of the Drupal Security Team

Project: Webform Submissions DeleteProject machine name: webform_submissions_deleteDate: 2026-September-02Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.2.0CVE IDs: CVE-2026-84921Description: 

This module enables you to delete Webform submissions in bulk using a specified date range.

The module doesn't sufficiently restrict access to the delete form.

A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+.

Solution: 

Install the latest version:

• If you use the Webform Submissions Delete module, upgrade to Webform Submissions Delete 8.x-1.2

Reported By: 

• Bernhard Karimi (bernhardk_oww)

Fixed By: 

• solideogloria

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Dan Smith (galooph) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Unpublished Node PermissionsProject machine name: unpublished_node_permissionsDate: 2026-September-02Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.8.0CVE IDs: CVE-2026-84920Description: 

This module creates permissions per node content type to control access to unpublished content.

The module has allowed view access for published content, overriding other access mechanisms that might have been in place.

Solution: 

Install the latest version:

• If you use the Unpublished Node Permissions module, upgrade to Unpublished Node Permissions 8.x-1.8.

Reported By: 

• Erwin Eggenberger (eeg)
• Jon Jordan (joncjordan)

Fixed By: 

• Fabien Gutknecht (fabsgugu)
• Jon Jordan (joncjordan)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: PhotoSwipe - Responsive JavaScript Modal Image GalleryProject machine name: photoswipeDate: 2026-September-02Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <5.0.9CVE IDs: CVE-2026-84919Description: 

This module enables you to add dynamic caption support to PhotoSwipe image galleries.

The module doesn't sufficiently sanitize user-supplied input (such as image alt tags) in its dynamic caption script, leading to a Cross-Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role that permits them to enter HTML content.

Solution: 

Install the latest version:

• If you use the photoswipe_dynamic_caption module, upgrade to photoswipe 5.0.9

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Joshua Sedler (grevil)
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Monobank payment APIProject machine name: monobankDate: 2026-September-02Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.0.3CVE IDs: CVE-2026-84918Description: 

The Monobank payment API module provides integration with Monobank acquiring payments.

The module did not verify the Monobank webhook signature before processing payment status callbacks.

Solution: 

Install the latest version:

• If you use the Monobank payment API module, upgrade to the monobank 1.0.3.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Helena Zajika (helena zajika)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Media Library ImporterProject machine name: media_library_importerDate: 2026-September-02Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.1.6CVE IDs: CVE-2026-81163Description: 

A module to import media files into media library.

The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media entity. Files that were deliberately kept outside the webroot, such as a private file store, become downloadable by anonymous visitors at a predictable URL.

Solution: 

Install the latest version:

• If you use the Media Library Importer module for Drupal upgrade to Media Library Importer 2.1.6

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Italo Mairo (itamair)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Mailer Plus LogProject machine name: symfony_mailer_logDate: 2026-September-02Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <1.2.7CVE IDs: CVE-2026-16648Description: 

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > Mail log.

The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can view the log can obtain a one-time login link for any account, including user 1, and use it to log in as that account.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission View Drupal Symfony Mailer log entries, which in earlier releases was not marked as a restricted permission.

Solution: 

Install the latest version:

• If you use the Mailer Plus Log module (previously known as Symfony Mailer Log), upgrade to Mailer Plus Log 1.2.7
• After updating, run database updates so that the email bodies already stored in the log are redacted.
• Review who should have the View Drupal Symfony Mailer log entries permission, and whether your site sends out custom sensitive emails that would need to opt in to the redaction logic.

Reported By: 

• Sven Decabooter (svendecabooter)

Fixed By: 

• Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
• Sven Decabooter (svendecabooter)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Mohit Aghera (mohit_aghera)

Project: Jsonapi Role Access Project machine name: jsonapi_role_accessDate: 2026-September-02Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.0.2CVE IDs: CVE-2026-84917Description: 

This module enables you to restrict access to JSON:API routes based on specific user roles.

The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest.

Solution: 

Install the latest version:

• If you use the Jsonapi Role Access module, upgrade to Jsonapi Role Access 2.0.2

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Julian Pustkuchen (anybody)
• Joshua Sedler (grevil)

Coordinated By: 

• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Islandora Project machine name: islandoraDate: 2026-September-02Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.19.0CVE IDs: CVE-2026-84916Description: 

This islandora_advanced_search sub module enables AJAX updates for advanced search, facet, and search result blocks.

The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content.

This vulnerability is mitigated by the fact that an attacker must know or guess a restricted block’s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions. Additionally, the submodule is not known to be used by any modern Islandora configurations.

Solution: 

Install the latest version:

• If you use the Islandora module, upgrade to the latest version Islandora 2.19.0. Be sure to read the release node for advice on updating

Reported By: 

• Joe Corall (joecorall)

Fixed By: 

• Annie Oelschlager (annieoelschlager)
• Joe Corall (joecorall)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Email Verification / SMS Verification / OTP VerificationProject machine name: otp_verificationDate: 2026-September-02Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingAffected versions: <2.4.0CVE IDs: CVE-2026-84924Description: 

This module enables you to add an extra layer of verification for user registration.

The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting (XSS) vulnerability.

Solution: 

Install the latest version:

If you are using the OTP Verification module for Drupal, upgrade to the latest version 8.x-2.4

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Mohammed Hisam (hisam45)
• Drew Webber (mcdruid) of the Drupal Security Team
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Email Verification / SMS Verification / OTP VerificationProject machine name: otp_verificationDate: 2026-September-02Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access BypassAffected versions: <2.4.0CVE IDs: CVE-2026-84923Description: 

This module enables you to add extra layer of verification for user registration.

The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability.

Solution: 

Install the latest version:

If you are using the OTP Verification module for Drupal, upgrade to latest version 8.x-2.4

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Mohammed Hisam (hisam45)
• Drew Webber (mcdruid) of the Drupal Security Team
• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Component blocksProject machine name: component_blocksDate: 2026-September-02Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: <1.2.7CVE IDs: CVE-2026-84915Description: 

This module enables you use UI Patterns with blocks, for use in Layout Builder.

The module doesn't sufficiently validate user input before passing to token replacement.

This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts.

Solution: 

Install the latest version:

• If you use the component_blocks module, upgrade to Component Blocks 1.2.7

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team

Project: Calculate Working DaysProject machine name: calculate_working_daysDate: 2026-September-02Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.0.3CVE IDs: CVE-2026-84914Description: 

Calculate Working Days allows you to calculate working days
between 2 dates.

This module doesn't sufficiently restrict access to its settings form.

Solution: 

Install the latest version:

• If you use the Calculate Working Days module, upgrade to calculate_working_days 2.0.3

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Vivek kumar (vivek_lnwebworks)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team