November 2026 - Security-news

Reset Password Email/SMS OTP - Critical - Access bypass - SA-CONTRIB-2026-305
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-305 Project: Reset Password Email/SMS OTP [1] Project machine name: reset_password_email_otp Date: 2026-November-04 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.5 CVE IDs: CVE-2026-122074 Description: This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The module doesn't sufficiently validate resetting passwords for blocked users. This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password. Solution: Install the latest version: * Upgrade to Reset Password Email/SMS OTP 1.0.5 [3]. Reported By: * Scott Euser (scott_euser) [4] Fixed By: * Andrii Sakhaniuk (nnevill) [5] * Scott Euser (scott_euser) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/reset_password_email_otp [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/reset_password_email_otp/releases/1.0.5 [4] https://www.drupal.org/u/scott_euser [5] https://www.drupal.org/u/nnevill [6] https://www.drupal.org/u/scott_euser [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Name Field - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-304
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-304 Project: Name Field [1] Project machine name: name Date: 2026-November-04 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <1.6.0 CVE IDs: CVE-2026-122073 Description: The Name Field module provides a field for storing a personal name as separate components. The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: * Upgrade to Name Field 8.x-1.6 [3]. Reported By: * Conrad Lara (cmlara) [4] Fixed By: * Steven Ayers (bluegeek9) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/name [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/name/releases/8.x-1.6 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/bluegeek9 [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Forum Access - Moderately critical - Access bypass - SA-CONTRIB-2026-303
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-303 Project: Forum Access [1] Project machine name: forum_access Date: 2026-November-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-122072 Description: This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access. This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API. Solution: Install the latest version: * Upgrade to Forum Access 2.0.3 [3]. Reported By: * nico.b [4] Fixed By: * Mikhail Khasaya (dillix) [5] * Kurucz István (nevergone) [6] * nico.b [7] * Hans Salvisberg (salvis) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Lee Rowlands (larowlan) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team * Jess (xjm) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/forum_access [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/forum_access/releases/2.0.3 [4] https://www.drupal.org/u/nicob [5] https://www.drupal.org/u/dillix [6] https://www.drupal.org/u/nevergone [7] https://www.drupal.org/u/nicob [8] https://www.drupal.org/u/salvis [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/poker10 [14] https://www.drupal.org/u/xjm [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Escrow - Moderately critical - Access bypass - SA-CONTRIB-2026-302
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-302 Project: Commerce Escrow [1] Project machine name: commerce_escrow Date: 2026-November-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.1.0 CVE IDs: CVE-2026-122071 Description: This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress. Solution: Install the latest version: * Upgrade to Commerce Escrow 1.1.0 [3]. (1.0.x versions are no longer supported.) After updating, register the new webhook URL with Escrow.com. It is shown on the configuration form of each Escrow payment gateway. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Valentino Međimorec (valic) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/commerce_escrow [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_escrow/releases/1.1.0 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/valic [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Product Alternative - Critical - Access bypass - SA-CONTRIB-2026-301
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-301 Project: Commerce Product Alternative [1] Project machine name: commerce_product_alternative Date: 2026-November-04 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.1 CVE IDs: CVE-2026-122070 Description: This module lets customers replace an item in their cart with one of the alternative product variations listed for it. The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts, including product names and prices, and replace those items with one of their listed alternatives. The vulnerability is mitigated by the fact that only carts of anonymous visitors are affected; carts of authenticated customers are not. Solution: Install the latest version: * Upgrade to Commerce Product Alternative 1.0.1 [3]. Reported By: * Tim de Jong (tim_dj) [4] Fixed By: * Jakub Piasecki (zaporylie) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/commerce_product_alternative [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_product_alternative/releases/1.0.1 [4] https://www.drupal.org/u/tim_dj [5] https://www.drupal.org/u/zaporylie [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AlternativeCommerce PayPal Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-300
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-300 Project: AlternativeCommerce PayPal Checkout [1] Project machine name: basket_paypal Date: 2026-November-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.1.1 || >=2.0.0 <2.0.0-beta2 CVE IDs: CVE-2026-122069 Description: The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal. The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment. Solution: Install the latest version: * Upgrade to AlternativeCommerce PayPal 1.1.1 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Helena Zajika (helena zajika) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/basket_paypal [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/basket_paypal/releases/1.1.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/helena-zajika [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Highlight Js syntax highlighter - Critical - Cross-site scripting - SA-CONTRIB-2026-299
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-299 Project: Highlight Js syntax highlighter [1] Project machine name: highlight_js Date: 2026-November-04 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.3.1 CVE IDs: CVE-2026-122068 Description: This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability. Solution: Install the latest version: * Upgrade to highlight_js 1.3.1 [3]. Reported By: * André Angelantoni (aangel) [4] * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By: * Norman Kämper-Leymann (norman.lol) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/highlight_js [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/highlight_js/releases/1.3.1 [4] https://www.drupal.org/u/aangel [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/normanlol [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

REST & JSON API Authentication for Drupal - Critical - Access bypass - SA-CONTRIB-2026-298
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-298 Project: REST & JSON API Authentication for Drupal [1] Project machine name: rest_api_authentication Date: 2026-November-04 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:None/CI:Some/II:All/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.2.1 CVE IDs: CVE-2026-122067 Description: The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated. Solution: Install the latest version: * Upgrade to REST & JSON API Authentication 3.2.1 [3]. If you can't immediately upgrade, ensure that you have an API key generated, and audit for suspicious access by administrative users in the logs. Reported By: * Sanjeev Kumar (ksanjeev284) [4] Fixed By: * Mohammed Hisam (hisam45) [5] * purva_shende [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/rest_api_authentication [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/rest_api_authentication/releases/3.2.1 [4] https://www.drupal.org/u/ksanjeev284 [5] https://www.drupal.org/u/hisam45 [6] https://www.drupal.org/u/purva_shende [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Workflow Notifications - Critical - Access bypass - SA-CONTRIB-2026-297
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-297 Project: Workflow Notifications [1] Project machine name: workflow_notifications Date: 2026-November-04 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <3.0.3 CVE IDs: CVE-2026-122066 Description: This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes. Solution: Install the latest version: * Upgrade to workflow_notifications 3.0.3 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * John Voskuilen (johnv) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/workflow_notifications [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/workflow_notifications/releases/3.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/johnv [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2026-296
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-296 Project: Simple OAuth (OAuth2) & OpenID Connect [1] Project machine name: simple_oauth Date: 2026-November-04 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <5.2.6 || >=6.0.0 <6.0.10 || >=6.1.0 <6.1.4 CVE IDs: CVE-2026-122058 Description: This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently restrict access to consumer configuration. Users who can create or edit consumers can potentially configure malicious consumers and obtain tokens with additional privileges. This can allow them to access the site as another user, up to full administrative access. This vulnerability is mitigated by the fact that an attacker must have a role with the /Add consumer entities/ or /Update own consumer entities/ permissions. Solution: Install the latest version: * If you use version 6.1.x, upgrade to Simple OAuth (OAuth2) & OpenID Connect 6.1.4 [3]. * If you use version 6.0.x, upgrade to Simple OAuth (OAuth2) & OpenID Connect 6.0.10 [4]. * If you use version 5.2.x, upgrade to Simple OAuth (OAuth2) & OpenID Connect 5.2.6 [5]. Additional steps are required after updating: * Configuring the access a consumer grants requires the new /Administer consumer access settings/ permission. Grant it only to trusted roles. * In 6.1.x, Client Credentials tokens are now always limited to their scopes. The update does not change existing consumers. Review them, and revoke their tokens if in doubt. Reported By: * Andrei Lungu (andrei.lungu) [6] * Drew Webber (mcdruid) [7] of the Drupal Security Team Fixed By: * Bojan Bogdanovic (bojan_dev) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/simple_oauth [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/simple_oauth/releases/6.1.4 [4] https://www.drupal.org/project/simple_oauth/releases/6.0.10 [5] https://www.drupal.org/project/simple_oauth/releases/5.2.6 [6] https://www.drupal.org/u/andreilungu [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/bojan_dev [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0