October 2026 - Security-news - lists.drupal.org

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-292 Project: Media Alias Display [1] Project machine name: media_alias_display Date: 2026-October-28 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Proof/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.1.3 || >=3.0.0 <3.0.3 CVE IDs: CVE-2026-118571 Description: This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245 [3], which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This vulnerability is mitigated by the following: * Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme. * An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached. Solution: Install the latest version: * If you use version 3.0.x, upgrade to 3.0.3 [4]. * If you use version 2.1.x, upgrade to 2.1.3 [5]. Reported By: * Pierre Rudloff (prudloff) [6] of the Drupal Security Team * Timothy Dickens (tregonia) [7] Fixed By: * Stephen Mustgrave (smustgrave) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Pierre Rudloff (prudloff) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/media_alias_display [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/sa-contrib-2026-245 [4] https://www.drupal.org/project/media_alias_display/releases/3.0.3 [5] https://www.drupal.org/project/media_alias_display/releases/2.1.3 [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/tregonia [8] https://www.drupal.org/u/smustgrave [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/prudloff [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-291 Project: Content Sync (content-sync.io) [1] Project machine name: cms_content_sync Date: 2026-October-28 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <3.2.2 CVE IDs: CVE-2026-118568 Description: This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an attacker must have access to a database dump or database read access to the user data table. This vulnerability is not exploitable without prior database access. Solution: Install the latest version: * If you use the cms_content_sync module, upgrade to cms_content_sync 3.2.2 [3]. Reported By: * Kalle Kipinä (kekkis) [4] Fixed By: * Alan Soldic (alancs26) [5] * azteroid [6] * Thiemo Müller (thiemo) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Damien McKenna (damienmckenna) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/cms_content_sync [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/cms_content_sync/releases/3.2.2 [4] https://www.drupal.org/u/kekkis [5] https://www.drupal.org/u/alancs26 [6] https://www.drupal.org/u/azteroid [7] https://www.drupal.org/u/thiemo [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-290 Project: OAuth2 Token Manager [1] Project machine name: oauth2_token_manager Date: 2026-October-28 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.2.0 CVE IDs: CVE-2026-118573 Description: This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to an account they control. This vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs). Solution: Install the latest version: * If you use the OAuth2 Token Manager module, upgrade to OAuth2 Token Manager 8.x-1.2 [3] After updating, run database updates. If you suspect your Box, Quip or Slack integration was connected to an unauthorized account, re-initialize the system token with Drush. Reported By: * Francesco Pesenti (peximo) [4] Fixed By: * Lucas Hedding (heddn) [5] * Francesco Pesenti (peximo) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/oauth2_token_manager [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/oauth2_token_manager/releases/8.x-1.2 [4] https://www.drupal.org/u/peximo [5] https://www.drupal.org/u/heddn [6] https://www.drupal.org/u/peximo [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-289 Project: Field Permissions [1] Project machine name: field_permissions Date: 2026-October-28 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-118584 Description: The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field configured as "Private" on one of these entities can be viewed. Where the entity is editable, the entity can also be edited by anyone who can view it, including anonymous users. This vulnerability is mitigated by the fact that an administrator must have configured a field as "Private" on an entity type that has no author, and the attacker must already be able to view that entity. Fields set to "Private" on nodes, users, media, comments, and other entity types with an author are not affected. Fields using /Custom permissions/ are not affected. Solution: Install the latest version: * If you use the Field Permissions module for Drupal 9.5, 10 or 11, upgrade to Field Permissions 8.x-1.6 [3]. Reported By: * Rodrigo Cabo (rodrigo-cabo) [4] Fixed By: * Jakob P (japerry) [5] * Rob Loach (robloach) [6] * Rodrigo Cabo (rodrigo-cabo) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Lee Rowlands (larowlan) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/field_permissions [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/field_permissions/releases/8.x-1.6 [4] https://www.drupal.org/u/rodrigo-cabo [5] https://www.drupal.org/u/japerry [6] https://www.drupal.org/u/robloach [7] https://www.drupal.org/u/rodrigo-cabo [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/larowlan [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-288 Project: Field Permissions [1] Project machine name: field_permissions Date: 2026-October-28 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-118583 Description: This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields. This vulnerability is mitigated by the fact that an attacker must have a role with the machine name administrator that is not flagged as the site's administrator role. Sites that use Drupal's default administrator role configuration are not affected. Solution: Install the latest version: * If you use the Field Permissions module, upgrade to Field Permissions 8.x-1.6 [3]. Reported By: * narbehm [4] Fixed By: * Jakob P (japerry) [5] * Mohit Aghera (mohit_aghera) [6] provisional member of the Drupal Security Team * narbehm [7] * Rob Loach (robloach) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Lee Rowlands (larowlan) [12] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [13], provisional member of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/field_permissions [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/field_permissions/releases/8.x-1.6 [4] https://www.drupal.org/u/narbehm [5] https://www.drupal.org/u/japerry [6] https://www.drupal.org/u/mohit_aghera [7] https://www.drupal.org/u/narbehm [8] https://www.drupal.org/u/robloach [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/mohit_aghera [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-287 Project: OpenID Connect Client [1] Project machine name: oidc Date: 2026-October-28 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper authentication Affected versions: <2.3.1 CVE IDs: CVE-2026-118554 Description: The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user. This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user. Solution: Install the latest version: * Upgrade to OpenID Connect Client 2.3.1 [3]. Linking new users to an existing account is now disabled by default and can be re-enabled on the settings page. When using a generic realm it's also highly recommended to configure the email verified claim. Reported By: * Sanjeev Kumar (ksanjeev284) [4] Fixed By: * Matthijs Van Assche (matthijs) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/oidc [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/oidc/releases/2.3.1 [4] https://www.drupal.org/u/ksanjeev284 [5] https://www.drupal.org/u/matthijs [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-286 Project: Stage File Proxy [1] Project machine name: stage_file_proxy Date: 2026-October-28 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <3.1.7 || >=4.0.0 <4.0.1 CVE IDs: CVE-2026-118576 Description: Stage File Proxy is a general solution for getting production files on a development server on demand. *It is not intended for usage on production sites.* The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module. Solution: Install the latest version: * If you use the stage_file_proxy module, upgrade to Stage File Proxy 4.0.1 [3] or Stage File Proxy 3.1.7 [4] Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Marcus Johansson (marcus_johansson) [6] * Stephen Mustgrave (smustgrave) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/stage_file_proxy [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/stage_file_proxy/releases/4.0.1 [4] https://www.drupal.org/project/stage_file_proxy/releases/3.1.7 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/smustgrave [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-285 Project: Signature pad widget [1] Project machine name: sign_widget Date: 2026-October-28 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.15.0 CVE IDs: CVE-2026-118575 Description: This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: * If you use the sign_widget module for Drupal 10.x/11.x, upgrade to Sign Widget 8.x-1.15 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] * Ra Mänd (ram4nd) [5], provisional member of the Drupal Security Team Fixed By: * Joseph Olstad (joseph.olstad) [6] * Marcus Johansson (marcus_johansson) [7] * Ra Mänd (ram4nd) [8], provisional member of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Heine Deelstra (heine) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/sign_widget [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/sign_widget/releases/8.x-1.15 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/ram4nd [6] https://www.drupal.org/u/josepholstad [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/ram4nd [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/heine [12] https://www.drupal.org/u/poker10 [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-284 Project: OAuth Login - OAuth OIDC SSO [1] Project machine name: oauth_login_oauth2 Date: 2026-October-28 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Authentication bypass Affected versions: <3.1.1 CVE IDs: CVE-2026-118572 Description: This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an attacker log in as any existing user whose email address they know. This vulnerability is mitigated by the fact that an attacker must have an account with an identity provider the site is configured to use. They must also be able to set the value of at least one attribute that provider returns, such as a username. Solution: Install the latest version: * If you use the OAuth Login - OAuth OIDC SSO module, upgrade to OAuth Login - OAuth OIDC SSO-3.1.1 [3]. Reported By: * Sanjeev Kumar (ksanjeev284) [4] Fixed By: * Akash khairnar (khairnarakash) [5] * Neetu Choudhary (neetu01) [6] * purva_shende [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/oauth_login_oauth2 [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/oauth_login_oauth2/releases/3.1.1 [4] https://www.drupal.org/u/ksanjeev284 [5] https://www.drupal.org/u/khairnarakash [6] https://www.drupal.org/u/neetu01 [7] https://www.drupal.org/u/purva_shende [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-283 Project: Fasttoggle [1] Project machine name: fasttoggle Date: 2026-October-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-Site Request Forgery Affected versions: <4.1.1 CVE IDs: CVE-2026-118570 Description: This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while logged in. This allows the attacker to change the publication status of arbitrary content on behalf of that user. This vulnerability is mitigated by the fact that an attacker must trick a user with the permission "Use Fasttoggle" into visiting an attacker-controlled page. Solution: Install the latest version: * If you use the Fasttoggle module, upgrade to Fasttoggle 4.1.1 [3] Reported By: * Nam Nguyen Le Thanh (yuwkaa) [4] Fixed By: * Andrei Ivnitskii (ivnish) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/fasttoggle [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/fasttoggle/releases/4.1.1 [4] https://www.drupal.org/u/yuwkaa [5] https://www.drupal.org/u/ivnish [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0