October 2026 - Security-news - lists.drupal.org

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-252 Project: Rabbit Hole [1] Project machine name: rabbit_hole Date: 2026-October-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access Bypass Affected versions: <1.3.0 CVE IDs: CVE-2026-114571 Description: Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the visitor to another URL. The module has two vulnerabilities. Rabbit Hole behavior can be skipped with a specific query parameter. In these cases, an affected entity made Rabbit Hole treat the request as an error page and do nothing. An anonymous visitor could view content a site had configured to return an access denied or not found response, or avoid a configured redirect. The per-entity settings are stored in fields that the module adds to supported entity types. The module only checks the "Administer Rabbit Hole settings for " permission when it decides whether to show those settings on the entity edit form. The fields themselves carry no access control, so Drupal's default field access applies and anyone who can edit the entity can also edit these fields. The first vulnerability affects every site that relies on Rabbit Hole to deny access to or hide entities. The second is mitigated by the fact that an attacker must have a role with permission to edit the affected entities, and the site must expose a write path that bypasses the entity form, such as JSON:API with writes enabled, REST, or Views Bulk Operations. Solution: Install the latest version: * If you use the rabbit_hole module, upgrade to rabbit_hole 8.x-1.3 [3] Sites that cannot update immediately can reduce exposure by disabling REST write methods and bulk operations for roles that do not hold the administer permission, or by removing the "Edit any content" permissions from untrusted roles. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Jakob P (japerry) [5] * Mohit Aghera (mohit_aghera) [6], provisional member of the Drupal Security Team Coordinated By: * Mohit Aghera (mohit_aghera) [7], provisional member of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/rabbit_hole [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/rabbit_hole/releases/8.x-1.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/japerry [6] https://www.drupal.org/u/mohit_aghera [7] https://www.drupal.org/u/mohit_aghera [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-251 Project: AI File to Text [1] Project machine name: ai_file_to_text Date: 2026-October-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.1 CVE IDs: CVE-2026-114554 Description: The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file before extracting its contents. This allows the contents of files the user could not otherwise download, including files held in the private file system, to be disclosed. This vulnerability is mitigated by the fact that an attacker must have a role with permission to invoke AI tools, for example through an agent or the AI API Explorer. Solution: Install the latest version: * If you use the AI File to Text module, upgrade to AI File to Text 1.0.1 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Ahmad Khader (ahmad khader) [5] * Marcus Johansson (marcus_johansson) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ai_file_to_text [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai_file_to_text/releases/1.0.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/ahmad-khader [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-250 Project: Data field [1] Project machine name: datafield Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <2.0.14 CVE IDs: CVE-2026-114555 Description: Data Field allows you to create custom fields with multiple values under the default table form. The file_uri formatter does not properly escape filenames when rendering links to uploaded files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield. Solution: Install the latest version: * If you use the Data Field module, upgrade to Data Field 2.0.14 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Drew Webber (mcdruid) [5] of the Drupal Security Team * Joseph Olstad (joseph.olstad) [6] * NGUYEN Bao (lazzyvn) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/datafield [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/datafield/releases/2.0.14 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/josepholstad [7] https://www.drupal.org/u/lazzyvn [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-249 Project: Domain Login Restrict [1] Project machine name: domain_login_restrict Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.5.0 CVE IDs: CVE-2026-114572 Description: This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to them. The module doesn't sufficiently enforce these restrictions when a user logs in by a method other than the standard login form. This vulnerability is mitigated by the fact that an attacker must have a valid user account on the site, and the "Enable restriction" setting must be enabled on the Domain settings page. Users with the "Login to any domain" permission are not affected by the restriction. Solution: Install the latest version: * If you use Domain Login Restrict, upgrade to Domain Login Restrict 8.x-1.5 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Sunil Pawar (sunilpawar) [5] Coordinated By: * Bram Driesen (bramdriesen) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/domain_login_restrict [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/domain_login_restrict/releases/8.x-1.5 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/sunilpawar [6] https://www.drupal.org/u/bramdriesen [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-248 Project: Shield [1] Project machine name: shield Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.9.0 CVE IDs: CVE-2026-107256 Description: The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled or indexed by anonymous visitors. The module doesn't sufficiently limit the number of authentication attempts it will evaluate under the scenario where an anonymous visitor repeatedly submits basic authentication credentials. This vulnerability is mitigated by the fact that the configured Shield credentials must be guessable — a long, randomly generated password is not practically brute forceable — and by the fact that Shield is intended as a supplementary barrier in front of a site rather than the site's user access control systems. Solution: Install the latest version: * If you use the shield module, upgrade to Shield 8.x-1.9 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Bram Driesen (bramdriesen) [5] of the Drupal Security Team * Merlin Axel Rutz (geek-merlin) [6] * Jakob P (japerry) [7] * Ivo Van Geertruyen (mr.baileys) [8] of the Drupal Security Team * Ra Mänd (ram4nd) [9] provisional member of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Pierre Rudloff (prudloff) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/shield [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/shield/releases/8.x-1.9 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/bramdriesen [6] https://www.drupal.org/u/geek-merlin [7] https://www.drupal.org/u/japerry [8] https://www.drupal.org/u/mrbaileys [9] https://www.drupal.org/u/ram4nd [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/prudloff [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-247 Project: ImageAPI Optimize WebP [1] Project machine name: imageapi_optimize_webp Date: 2026-October-21 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.1.2 CVE IDs: CVE-2026-114548 Description: This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them. The module serves WebP image derivative responses with the HTTP header Cache-Control: public for all file schemes other than the private file system, including the temporary file system and access-controlled custom schemes. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN. This vulnerability is mitigated by the fact that it only affects sites that serve image derivatives from a custom or temporary file scheme with access control, behind a shared cache that honors the Cache-Control header. Access checks are still enforced on requests that reach the site itself. An attacker would also need to know the path of a previously requested file still in cache. This is the same vulnerability class fixed in Drupal core by SA-CORE-2025-008 [3] and SA-CORE-2026-010 [4]; the module's controller override reintroduced the behavior. Solution: Install the latest version: * If you use the ImageAPI Optimize WebP module 2.1.x, upgrade to ImageAPI Optimize WebP 2.1.2 [5] * ImageAPI Optimize WebP 2.0.x only supports Drupal 10.1 and 10.2, which are end-of-life. It will not receive a security update and is no longer supported. Reported By: * Pierre Rudloff (prudloff) [6] of the Drupal Security Team Fixed By: * Michael Lander (michaellander) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/imageapi_optimize_webp [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/sa-core-2025-008 [4] https://www.drupal.org/sa-core-2026-010 [5] https://www.drupal.org/project/imageapi_optimize_webp/releases/2.1.2 [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/michaellander [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-246 Project: TinyPNG [1] Project machine name: tinypng Date: 2026-October-21 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.0.2 Description: TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images. Solution: Install the latest version: * If you use TinyPNG 2.0.x, upgrade to TinyPNG 2.0.2 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * István Csáki (csakiistvan) [5] * Vince Tikász (tikaszvince) [6] Coordinated By: * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/tinypng [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/tinypng/releases/2.0.2 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/csakiistvan [6] https://www.drupal.org/u/tikaszvince [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-245 Project: Media Alias Display [1] Project machine name: media_alias_display Date: 2026-October-21 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.1.2 || >=3.0.0 <3.0.2 CVE IDs: CVE-2026-114546 Description: This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This vulnerability is mitigated by the following: * Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme. * An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached. Solution: Install the latest version: * If you use the media_alias_display module 3.0.x, upgrade to 3.0.2 [3] * If you use the media_alias_display module 2.1.x, upgrade to 2.1.2 [4] Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Stephen Mustgrave (smustgrave) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/media_alias_display [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/media_alias_display/releases/3.0.2 [4] https://www.drupal.org/project/media_alias_display/releases/2.1.2 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/smustgrave [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/prudloff [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-244 Project: Fullcalendar View [1] Project machine name: fullcalendar_view Date: 2026-October-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <5.2.6 CVE IDs: CVE-2026-114545 Description: This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself. Solution: Install the latest version: * If you use the Fullcalendar View module, upgrade to Fullcalendar View 5.2.6 [3] Reported By: * Maksim Hayder (tr_jan) [4] Fixed By: * Mingsong (mingsong) [5], provisional member of the Drupal Security Team Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [7] [1] https://www.drupal.org/project/fullcalendar_view [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/fullcalendar_view/releases/5.2.6 [4] https://www.drupal.org/u/tr_jan [5] https://www.drupal.org/u/mingsong [6] https://www.drupal.org/u/poker10 [7] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-243 Project: Media Bulk Upload [1] Project machine name: media_bulk_upload Date: 2026-October-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <3.0.6 CVE IDs: CVE-2026-114544 Description: This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "bulk upload form". Solution: Install the latest version: * If you use Media Bulk Upload module, upgrade to Media Bulk Upload 3.0.6 [3] Reported By: * Stuart Rowlands (stooit) [4] Fixed By: * Jen M (jannakha) [5] * Sjoerd Wenker (sjerdo) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/media_bulk_upload [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/media_bulk_upload/releases/3.0.6 [4] https://www.drupal.org/u/stooit [5] https://www.drupal.org/u/jannakha [6] https://www.drupal.org/u/sjerdo [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0