October 2026 - Security-news - lists.drupal.org

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-207 Project: Two Factor Authentication - TFA / Passwordless Login [1] Project machine name: miniorange_2fa Date: 2026-October-07 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Affected versions: <5.4.1 || >=5.5.0 <5.5.2 CVE IDs: CVE-2026-107268 Description: This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated users. The vulnerability is mitigated by the fact that Headless 2FA must be turned on by a user with a miniorange 2fa headless permission, which is a restricted permission. Solution: Install the latest version: * If you use the 5.5.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.5.2 [3] * If you use the 5.4.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.4.1 [4] Reported By: * Nam Nguyen Le Thanh (yuwkaa) [5] Fixed By: * Mohammed Hisam (hisam45) [6] * Nam Nguyen Le Thanh (yuwkaa) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/miniorange_2fa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_2fa/releases/5.5.2 [4] https://www.drupal.org/project/miniorange_2fa/releases/5.4.1 [5] https://www.drupal.org/u/yuwkaa [6] https://www.drupal.org/u/hisam45 [7] https://www.drupal.org/u/yuwkaa [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-206 Project: Xray Audit [1] Project machine name: xray_audit Date: 2026-October-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.1.1 || >=2.0.0 <2.0.4 || >=3.1.0 <3.1.1 || 1.2.* || 1.3.* || 1.4.* || 1.5.* || 3.0.* CVE IDs: CVE-2026-96389 Description: This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content. This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed. Solution: Install the latest versions: * If you use the X-ray Audit version 3.1.x, upgrade to X-ray Audit 3.1.1 [3]. * If you use the X-ray Audit version 2.0.x, upgrade to X-ray Audit 2.0.4 [4]. * If you use the X-ray Audit version 1.6.x, upgrade to X-ray Audit 1.6.3 [5]. Reported By: * eduardo morales alberti [6] * Hemant Gupta (guptahemant) [7] * Marcus Johansson (marcus_johansson) [8] * Drew Webber (mcdruid) [9] of the Drupal Security Team Fixed By: * Luis Ruiz Peidró (lpeidro) [10] Coordinated By: * Swan Kalata (akalata) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/xray_audit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/xray_audit/releases/3.1.1 [4] https://www.drupal.org/project/xray_audit/releases/2.0.4 [5] https://www.drupal.org/project/xray_audit/releases/1.6.3 [6] https://www.drupal.org/u/eduardo-morales-alberti [7] https://www.drupal.org/u/guptahemant [8] https://www.drupal.org/u/marcus_johansson [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/lpeidro [11] https://www.drupal.org/u/akalata [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/poker10 [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-205 Project: Views Share [1] Project machine name: views_share Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.1 CVE IDs: CVE-2026-107266 Description: This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability is mitigated by the fact that an attacker must know the view and display IDs. Solution: Install the latest version: * If you use the Views Share module, upgrade to Views Share 2.0.1 [3] Reported By: * Hemant Gupta (guptahemant) [4] Fixed By: * Daniel Cothran (andileco) [5] * Hemant Gupta (guptahemant) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/views_share [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views_share/releases/2.0.1 [4] https://www.drupal.org/u/guptahemant [5] https://www.drupal.org/u/andileco [6] https://www.drupal.org/u/guptahemant [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-204 Project: Leaflet [1] Project machine name: leaflet Date: 2026-October-07 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <10.4.13 CVE IDs: CVE-2026-107265 Description: The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacker needs to have permission to create or edit content that is used in a Leaflet map. Solution: Install the latest version: * If you use the Leaflet module, upgrade to release 10.4.13 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Italo Mairo (itamair) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/leaflet [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/leaflet/releases/10.4.13 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/itamair [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-203 Project: Inline Formatter Field [1] Project machine name: inline_formatter_field Date: 2026-October-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Server-side template injection Affected versions: <4.2.0 CVE IDs: CVE-2026-107264 Description: The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands. Solution: Install the latest version: * If you use the Inline Formatter Field module, upgrade to Inline Formatter Field 4.2.0 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Bobby Saul (bobbysaul) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/inline_formatter_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/inline_formatter_field/releases/4.2.0 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/bobbysaul [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-202 Project: Gutenberg [1] Project machine name: gutenberg Date: 2026-October-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.15.0 || >=3.0.0 <3.0.7 || >=4.0.0 <4.0.0-beta3 CVE IDs: CVE-2026-107263 Description: This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission. Solution: Install the latest version: * If you use the Gutenberg module versions 3.0.x, upgrade to Gutenberg 3.0.7 [3] * If you use the Gutenberg module versions 8.x-2.x, upgrade to Gutenberg 8.x-2.15 [4] Reported By: * Tommaso Gregori (p1s1o) [5] * Drew Webber (mcdruid) [6] of the Drupal Security Team Fixed By: * Stephan Zeidler (szeidler) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/gutenberg [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gutenberg/releases/3.0.7 [4] https://www.drupal.org/project/gutenberg/releases/8.x-2.15 [5] https://www.drupal.org/u/p1s1o [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/szeidler [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-201 Project: Authenticator Login Plus (2FA) [1] Project machine name: auth_login_plus Date: 2026-October-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper authentication Affected versions: <1.0.1 CVE IDs: CVE-2026-107261 Description: This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on. Solution: *Install the latest version:* * If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1 [3]. After upgrading, users who previously disabled 2FA will be asked to set it up again at their next login. Administrators can also re-enable 2FA for a user from the admin overview so the user keeps their existing authenticator. Reported By: * mouhamed rayen mansouri (w0nd3r) [4] Fixed By: * mugesh.s [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/auth_login_plus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/auth_login_plus/releases/1.0.1 [4] https://www.drupal.org/u/w0nd3r [5] https://www.drupal.org/u/mugeshs [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-200 Project: Linked Field [1] Project machine name: linked_field Date: 2026-October-07 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Server-side template injection Affected versions: <1.8.0 CVE IDs: CVE-2026-107259 Description: This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site configuration values, which may include sensitive information such as API keys or credentials. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content in a field that has Linked Field enabled in its display settings. Solution: Install the latest version: * If you use the Linked Field module for Drupal 8.x or later, update to Linked Field 8.x-1.8 [3] Reported By: * Maksim Hayder (tr_jan) [4] Fixed By: * Vitaliy Bogomazyuk (vitaliyb98) [5] * Yannick (yannickoo) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/linked_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/linked_field/releases/8.x-1.8 [4] https://www.drupal.org/u/tr_jan [5] https://www.drupal.org/u/vitaliyb98 [6] https://www.drupal.org/u/yannickoo [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-199 Project: Inline Entity Form Dialog [1] Project machine name: inline_entity_form_dialog Date: 2026-October-07 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.6 CVE IDs: CVE-2026-107258 Description: This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages". Solution: Install the latest version: * If you use the Inline Entity Form Dialog module for Drupal 11, upgrade to Inline Entity Form Dialog 1.0.6 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Marcus Johansson (marcus_johansson) [5] * Zeeshaan khann (zeeshan_khan) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/inline_entity_form_dialog [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/inline_entity_form_dialog/releases/1.0.6 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/zeeshan_khan [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Actstream - Critical - Access bypass - SA-CONTRIB-2026-198
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-198 Project: Actstream [1] Project machine name: actstream Date: 2026-October-07 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.1 || >=2.1.0 <2.1.1 CVE IDs: CVE-2026-107257 Description: Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities. The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability. Solution: Install the latest version: * If you use Actstream 2.1.x, upgrade to Actstream 2.1.1 [3]. * If you use Actstream 2.0.x, upgrade to Actstream 2.0.1 [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Reva Gomes (revagomes) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/actstream [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/actstream/releases/2.1.1 [4] https://www.drupal.org/project/actstream/releases/2.0.1 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/revagomes [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0