October 2026 - Security-news - lists.drupal.org

Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-242 Project: Simple OAuth (OAuth2) & OpenID Connect [1] Project machine name: simple_oauth Date: 2026-October-21 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: >=6.1.0 <6.1.3 CVE IDs: CVE-2026-114542 Description: This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. Since version 6.1.0, the module could cache a token's permissions in a way that let them be reused for another user's token with the same scopes. A user could gain permissions they do not have, including administrative access. This vulnerability is mitigated by the fact that an attacker needs an OAuth2 token, and cannot trigger the issue themselves: a more privileged user's token with the same scopes must be used first. User 1 is not affected unless security.enable_super_user is set to false. Solution: Install the latest version: * If you use the "Simple OAuth (OAuth2) & OpenID Connect >= 6.1.0", upgrade to Simple OAuth (OAuth2) & OpenID Connect 6.1.3 [3] Reported By: * Jonathan Shaw (jonathanshaw) [4] * Alexander Varwijk (kingdutch) [5] * Mingsong (mingsong) [6], provisional member of the Drupal Security Team * Trevor Bradley (trevorbradley) [7] Fixed By: * Bojan Bogdanovic (bojan_dev) [8] * Alexander Varwijk (kingdutch) [9] * Mingsong (mingsong) [10], provisional member of the Drupal Security Team * Trevor Bradley (trevorbradley) [11] * Jonathan Shaw (jonathanshaw) [12] Coordinated By: * Swan Kalata (akalata) [13] of the Drupal Security Team * Benji Fisher (benjifisher) [14] of the Drupal Security Team * Damien McKenna (damienmckenna) [15] of the Drupal Security Team * Neil Drumm (drumm) [16] of the Drupal Security Team * Juraj Nemec (poker10) [17] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [18] [1] https://www.drupal.org/project/simple_oauth [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/simple_oauth/releases/6.1.3 [4] https://www.drupal.org/u/jonathanshaw [5] https://www.drupal.org/u/kingdutch [6] https://www.drupal.org/u/mingsong [7] https://www.drupal.org/u/trevorbradley [8] https://www.drupal.org/u/bojan_dev [9] https://www.drupal.org/u/kingdutch [10] https://www.drupal.org/u/mingsong [11] https://www.drupal.org/u/trevorbradley [12] https://www.drupal.org/u/trevorbradley [13] https://www.drupal.org/u/akalata [14] https://www.drupal.org/u/benjifisher [15] https://www.drupal.org/u/damienmckenna [16] https://www.drupal.org/u/drumm [17] https://www.drupal.org/u/poker10 [18] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-241 Project: Frontend Editing [1] Project machine name: frontend_editing Date: 2026-October-21 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.9.3 CVE IDs: CVE-2026-114553 Description: This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "access frontend editing", "add paragraphs"/"edit paragraphs"/"delete paragraphs" and also have access to update the parent entity the field belongs to. Solution: Install the latest version: * If you use the frontend_editing module, upgrade to frontend_editing 1.9.3 [3] Reported By: * Artem Dmitriiev (a.dmitriiev) [4] Fixed By: * Artem Dmitriiev (a.dmitriiev) [5] * Bruno Bruno (bbruno) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/frontend_editing [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/frontend_editing/releases/1.9.3 [4] https://www.drupal.org/u/admitriiev [5] https://www.drupal.org/u/admitriiev [6] https://www.drupal.org/u/bbruno [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-240 Project: Frontend Editing [1] Project machine name: frontend_editing Date: 2026-October-21 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-Site Request Forgery (CSRF) Affected versions: <1.9.3 CVE IDs: CVE-2026-114541 Description: This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery (CSRF). An attacker could trick an editor into visiting a crafted link, which deletes or reorders paragraphs on a node using the editor's permissions. This vulnerability is mitigated by the fact that the victim must be logged in with permission to edit the content and to delete or move paragraphs. Solution: Install the latest version: * If you use Frontend Editing, upgrade to Frontend Editing 1.9.3 [3]. Reported By: * Artem Dmitriiev (a.dmitriiev) [4] Fixed By: * Artem Dmitriiev (a.dmitriiev) [5] * Norman Kämper-Leymann (norman.lol) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/frontend_editing [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/frontend_editing/releases/1.9.3 [4] https://www.drupal.org/u/admitriiev [5] https://www.drupal.org/u/admitriiev [6] https://www.drupal.org/u/normanlol [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-239 Project: Simple User Management [1] Project machine name: simple_user_management Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.11.0 CVE IDs: CVE-2026-114543 Description: This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect user 1 from being deactivated or deleted. This vulnerability is mitigated by the fact that an attacker must have a role with one of the module's additional action permissions. Solution: Install the latest version: * If you use the Simple User Management module, upgrade to Simple User Management 8.x-1.11 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Scott Euser (scott_euser) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/simple_user_management [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/simple_user_management/releases/8.x-1.11 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/scott_euser [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/prudloff [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-238 Project: Domain [1] Project machine name: domain Date: 2026-October-21 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <3.0.2 Description: This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled. This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain. Solution: Install the latest version: * If you use the Domain 3.0.x, upgrade to Domain 3.0.2 [3] The 2.0.x branch of the module is not affected by this vulnerability. Reported By: * Frank Mably (mably) [4] Fixed By: * Frank Mably (mably) [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [7] [1] https://www.drupal.org/project/domain [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/domain/releases/3.0.2 [4] https://www.drupal.org/u/mably [5] https://www.drupal.org/u/mably [6] https://www.drupal.org/u/poker10 [7] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-237 Project: DocCheck Basic [1] Project machine name: doccheck_basic Date: 2026-October-21 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2026-114539 Description: This module allows healthcare professionals to log in to a shared account on the Drupal website using their DocCheck credentials. The module doesn't sufficiently verify the authentication data with DocCheck API in some cases. Solution: Install the latest version: * If you use the doccheck_basic module, upgrade to Doccheck_Basic 2.2.1 [3] Reported By: * Rodel Duterte (rduterte) [4] Fixed By: * sleitner [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [7] [1] https://www.drupal.org/project/doccheck_basic [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/doccheck_basic/releases/2.2.1 [4] https://www.drupal.org/u/rduterte [5] https://www.drupal.org/u/sleitner [6] https://www.drupal.org/u/poker10 [7] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-236 Project: Bootstrap [1] Project machine name: bootstrap Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <3.45.0 CVE IDs: CVE-2026-114538 Description: Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability. This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme. Solution: Install the latest version: * If you use Bootstrap 8.x-3.x, upgrade to Bootstrap 8.x-3.45 [3] The 5.0.x branch of Bootstrap is not affected. Reported By: * Ra Mänd (ram4nd) [4], provisional member of the Drupal Security Team Fixed By: * Joseph Olstad (joseph.olstad) [5] * Ra Mänd (ram4nd) [6], provisional member of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Ra Mänd (ram4nd) [9], provisional member of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/bootstrap [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/bootstrap/releases/8.x-3.45 [4] https://www.drupal.org/u/ram4nd [5] https://www.drupal.org/u/josepholstad [6] https://www.drupal.org/u/ram4nd [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/ram4nd [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-235 Project: View Unpublished [1] Project machine name: view_unpublished Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.5.0 CVE IDs: CVE-2026-114537 Description: This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node access modules, such as Content Access or Domain Access, that might have been in place for these translations. This vulnerability is mitigated by the fact that the site must be multilingual, a node must have both unpublished and published translations, and another node access module must restrict view access to the published translations. Solution: Install the latest version: * If you use the View Unpublished, upgrade to View Unpublished 8.x-1.5 [3] Reported By: * Andrew L (andrew_l) [4] * Tobias Bähr (tobiasb) [5] Fixed By: * Oleksandr Kuzava (nginex) [6] * Gonçalo Mateus (lolgm) [7] * Tobias Bähr (tobiasb) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/view_unpublished [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/view_unpublished/releases/8.x-1.5 [4] https://www.drupal.org/u/andrew_l [5] https://www.drupal.org/u/tobiasb [6] https://www.drupal.org/u/nginex [7] https://www.drupal.org/u/lolgm [8] https://www.drupal.org/u/tobiasb [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-234 Project: USWDS Paragraph Components [1] Project machine name: uswds_paragraph_components Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <3.1.3 CVE IDs: CVE-2026-114536 Description: This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bundles provided by the module. Solution: Install the latest version: * If you use the USWDS Paragraph Components, upgrade to USWDS Paragraph Components 3.1.3 [3] Reported By: * Hemant Gupta (guptahemant) [4] * Lee Rowlands (larowlan) [5] of the Drupal Security Team Fixed By: * Stephen Mustgrave (smustgrave) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Lee Rowlands (larowlan) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/uswds_paragraph_components [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/uswds_paragraph_components/releases/3.1.3 [4] https://www.drupal.org/u/guptahemant [5] https://www.drupal.org/u/larowlan [6] https://www.drupal.org/u/smustgrave [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-233 Project: Swiper formatter [1] Project machine name: swiper_formatter Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <2.1.2 || >=3.0.0 <3.1.0 CVE IDs: CVE-2026-114535 Description: Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the specific entity. This vulnerability is mitigated by the fact that only rendered output is returned, and field-level access controls are still enforced. Solution: Install the latest version: * If you use the Swiper formatter module 3.x, upgrade to Swiper formatter 3.1.0 [3] * If you use the Swiper formatter module 2.x, upgrade to Swiper formatter 2.1.2 [4] Reported By: * Ryan Solomon (phizes) [5] * Julian Pustkuchen (anybody) [6] * Joshua Sedler (grevil) [7] Fixed By: * Drupal Lady (bbu23) [8] * Joshua Sedler (grevil) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/swiper_formatter [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/swiper_formatter/releases/3.1.0 [4] https://www.drupal.org/project/swiper_formatter/releases/2.1.2 [5] https://www.drupal.org/u/phizes [6] https://www.drupal.org/u/anybody [7] https://www.drupal.org/u/grevil [8] https://www.drupal.org/u/bbu23 [9] https://www.drupal.org/u/grevil [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/poker10 [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0