June 2026 - Security-news - lists.drupal.org

Tealium iQ Tag Management - Critical - Unsupported - SA-CONTRIB-2026-064
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-064 Project: Tealium iQ Tag Management [1] Date: 2026-June-24 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-13244 Description: The security team is marking the Tealium iQ Tag Management module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Coordinated By: * Benji Fisher (benjifisher) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185189-tealiumiq-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/tealiumiq [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/benjifisher [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://git.drupalcode.org/security/185189-tealiumiq-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-063 Project: Salesforce Suite [1] Date: 2026-June-24 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site request forgery Affected versions: <5.1.3 CVE IDs: CVE-2026-13243 Description: The Salesforce Suite of modules integrates Drupal with Salesforce. The Salesforce module does not properly validate the OAuth handshake during interactive authentication, allowing an attacker to hijack the authorization token and bind the site to an attacker's Salesforce account. This vulnerability is mitigated by the fact that salesforce_oauth submodule must be enabled, and a salesforce_oauth authorization profile active and in use. The submodule salesforce_oauth is deprecated, and salesforce_jwt has been the recommended authentication plugin for several years. Sites with salesforce_oauth uninstalled, or sites relying exclusively on salesforce_jwt (JWT or JWT Gov Cloud) for authentication are not impacted. Submodule salesforce_oauth has been removed in branch 6.0.x, so >= 6.0.x versions are not affected by this vulnerability. Solution: *Recommended solution:* * Update to Salesforce Suite version 5.1.3 [3] * Uninstall salesforce_oauth module *Alternative solution*, if you must continue to use salesforce_oauth module: * Update to Salesforce Suite version 5.1.3 [4] * Revoke existing oauth provider tokens * Re-authenticate all existing oauth providers Reported By: * Muhammedali Aliyev (swordmein) [5] Fixed By: * Aaron Bauman (aaronbauman) [6] Coordinated By: * Neil Drumm (drumm) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Pierre Rudloff (prudloff) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185127-salesforce-security/-/work_items… [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/salesforce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/salesforce/releases/5.1.3 [4] https://www.drupal.org/project/salesforce/releases/5.1.3 [5] https://www.drupal.org/u/swordmein [6] https://www.drupal.org/u/aaronbauman [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/prudloff [10] https://git.drupalcode.org/security/185127-salesforce-security/-/work_items… [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-062 Project: Geolocation Field [1] Date: 2026-June-24 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: SQL Injection Affected versions: <3.15.0 CVE IDs: CVE-2026-13242 Description: Geolocation modules adds a field to store coordinates and provides supporting plumbing for views and other modules. One of the provided views filters does not sufficiently sanitize values if exposed to user input resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a view must exist, that uses the aforementioned filter and it is set to accept user input. Solution: Install the latest version: * If you use the Geolocation Field module for Drupal, upgrade to Geolocation Field 8.x-3.15 [3] Reported By: * Michael Maturi (michaelmaturi) [4] Fixed By: * Michael Maturi (michaelmaturi) [5] * Christian Adamski (christianadamski) [6] Coordinated By: * cilefen (cilefen) [7] of the Drupal Security Team * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185170-geolocation-security/-/work_item… [12] ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/geolocation [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/geolocation/releases/8.x-3.15 [4] https://www.drupal.org/u/michaelmaturi [5] https://www.drupal.org/u/michaelmaturi [6] https://www.drupal.org/u/christianadamski [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://git.drupalcode.org/security/185170-geolocation-security/-/work_item… [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-061 Project: Paragraphs [1] Date: 2026-June-24 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.21.0 CVE IDs: CVE-2026-13241 Description: The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficiently restrict access to direct child paragraphs of library items through API endpoints. This vulnerability is mitigated by the fact the paragraphs_library module must be in use and general write access to paragraphs through another module must be allowed. Solution: Install the latest version: * If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21 [3] Reported By: * Mustafa Ahmed (mustafa007) [4] Fixed By: * Sascha Grossenbacher (berdir) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185093-paragraphs-security/-/work_items… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/paragraphs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/paragraphs/releases/8.x-1.21 [4] https://www.drupal.org/u/mustafa007 [5] https://www.drupal.org/u/berdir [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://git.drupalcode.org/security/185093-paragraphs-security/-/work_items… [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-060 Project: Paragraphs [1] Date: 2026-June-24 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.21.0 CVE IDs: CVE-2026-13240 Description: The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficiently restrict access to unpublished library items in lists. This vulnerability is mitigated by the fact the paragraphs_library module must be in use, and that an attacker must have access to a list of library items, such as a field with autocomplete suggestions or a view. Solution: Install the latest version: * If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Sascha Grossenbacher (berdir) [5] * Pierre Rudloff (prudloff) [6] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185207-paragraphs-security/-/work_items… [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/paragraphs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/paragraphs/releases/8.x-1.21 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/berdir [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/prudloff [9] https://git.drupalcode.org/security/185207-paragraphs-security/-/work_items… [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

WissKI - Critical - Access bypass - SA-CONTRIB-2026-059
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-059 Project: WissKI [1] Date: 2026-June-24 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <4.2.0 CVE IDs: CVE-2026-13239 Description: The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer. It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass. This vulnerability is mitigated by the fact that it is specific to the wisski_mirador submodule. Solution: Install the latest version: * If you use the WissKI module version 8.x-4.1, upgrade to WissKI 8.x-4.2 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * knurg [5] Coordinated By: * cilefen (cilefen) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185226-wisski-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/wisski [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/wisski/releases/8.x-4.2 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/knurg [6] https://www.drupal.org/u/cilefen [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185226-wisski-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-058 Project: Commerce Realex / Global Payments [1] Date: 2026-June-24 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Affected versions: <3.0.2 CVE IDs: CVE-2026-13238 Description: This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a lightbox iframe or via a full-page redirect. When the gateway is configured with the *redirect* payment method, the module doesn't sufficiently verify the authenticity of the payment response returned by Global Payments. The *lightbox* payment method validates the signature and is not affected, so sites that use the lightbox payment method are not affected. Solution: Install the latest version: * If you use the commerce_realex module <=3.0.1, upgrade to commerce_realex 3.0.2 [3]. The redirect payment response is now cryptographically verified against the merchant shared secret . Sites that cannot update immediately should disable this payment gateway, until the update can be applied. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] * Jaime Seuma (jaims-dev) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185236-commerce_realex-security/-/work_… [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce_realex [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_realex/releases/3.0.2 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/jaims-dev [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185236-commerce_realex-security/-/work_… [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-057 Project: AI Agents [1] Date: 2026-June-24 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure, Access bypass Affected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1 CVE IDs: CVE-2026-13237 Description: This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. Under certain circumstances, the agent inherits deterministic parameters when invoking the same tool in one request, which can lead to information disclosure. Solution: Install the latest version: * If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4 [3] * If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5 [4] * If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1 [5] Reported By: * Andrew Belcher (andrewbelcher) [6] * Rob Edwards (rob_e) [7] Fixed By: * Andrew Belcher (andrewbelcher) [8] * Marcus Johansson (marcus_johansson) [9] * Rob Edwards (rob_e) [10] Coordinated By: * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Drew Webber (mcdruid) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1 [15] ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/ai_agents [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_agents/releases/1.1.4 [4] https://www.drupal.org/project/ai_agents/releases/1.2.5 [5] https://www.drupal.org/project/ai_agents/releases/1.3.1 [6] https://www.drupal.org/u/andrewbelcher [7] https://www.drupal.org/u/rob_e [8] https://www.drupal.org/u/andrewbelcher [9] https://www.drupal.org/u/marcus_johansson [10] https://www.drupal.org/u/rob_e [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/mcdruid [14] https://www.drupal.org/u/poker10 [15] https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1 [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-056 Project: AI Agents [1] Date: 2026-June-24 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1 CVE IDs: CVE-2026-13236 Description: This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. The module does not sufficiently check the required permissions when a tool loads content entities. This vulnerability is mitigated by the fact that an agent must be configured to use the affected tool, and an attacker must have access to that agent. Solution: Install the latest version: * If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4 [3] * If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5 [4] * If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1 [5] Reported By: * Kuniyoshi Noguchi (kuninogu) [6] Fixed By: * Artem Dmitriiev (a.dmitriiev) [7] * AKHIL BABU (akhil babu) [8] * harivansh sharma (harivansh) [9] * Kuniyoshi Noguchi (kuninogu) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Bram Driesen (bramdriesen) [12] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3586041-ai_agents-security/-/work_items… [13] ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/ai_agents [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_agents/releases/1.1.4 [4] https://www.drupal.org/project/ai_agents/releases/1.2.5 [5] https://www.drupal.org/project/ai_agents/releases/1.3.1 [6] https://www.drupal.org/u/kuninogu [7] https://www.drupal.org/u/admitriiev [8] https://www.drupal.org/u/akhil-babu [9] https://www.drupal.org/u/harivansh [10] https://www.drupal.org/u/kuninogu [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/bramdriesen [13] https://git.drupalcode.org/security/3586041-ai_agents-security/-/work_items… [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-055 Project: AI (Artificial Intelligence) [1] Date: 2026-June-24 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3 CVE IDs: CVE-2026-13235 Description: This module enables you to utilize an agent to use Drupal core actions tools with bypassed access. Certain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions. This vulnerability is mitigated by the fact that an attacker must have access to communicate with an affected agent, the site must be configured to expose the affected tools to non-privileged users. Solution: Install the latest version: * If you use the AI module 1.2.16, upgrade to AI 1.2.17 [3] * If you use the AI module 1.3.7 upgrade to AI 1.3.8 [4] * If you use the AI module 1.4.2 upgrade to AI 1.4.3 [5] Reported By: * AKHIL BABU (akhil babu) [6] * Kuniyoshi Noguchi (kuninogu) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Marcus Johansson (marcus_johansson) [9] * Dezső Biczó (mxr576) [10] * Valery Lourie (valthebald) [11] Coordinated By: * Bram Driesen (bramdriesen) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3586526-ai-security/-/work_items/1 [16] ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.2.17 [4] https://www.drupal.org/project/ai/releases/1.3.8 [5] https://www.drupal.org/project/ai/releases/1.4.3 [6] https://www.drupal.org/u/akhil-babu [7] https://www.drupal.org/u/kuninogu [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/marcus_johansson [10] https://www.drupal.org/u/mxr576 [11] https://www.drupal.org/u/valthebald [12] https://www.drupal.org/u/bramdriesen [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/poker10 [16] https://git.drupalcode.org/security/3586526-ai-security/-/work_items/1 [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0