July 2026 - Security-news - lists.drupal.org

Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-081 Project: Internationalization Single Sign-On [1] Date: 2026-July-22 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.8.0 CVE IDs: CVE-2026-16639 Description: In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain. The module doesn't sufficiently validate a short-lived token, allowing an attacker to bypass access control and authenticate as a victim user. This vulnerability is mitigated by the fact that an attacker must appear to originate from the same client IP as the victim. Solution: Install the latest version: * If you use the Internationalization Single Sign-On module upgrade to i18n_sso 8.x-1.8 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Florent Torregrosa (grimreaper) [5] * Drew Webber (mcdruid) [6] of the Drupal Security Team Coordinated By: * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/i18n_sso [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/i18n_sso/releases/8.x-1.8 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/grimreaper [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-080 Project: Media Folders [1] Date: 2026-July-22 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <1.0.8 CVE IDs: CVE-2026-16638 Description: This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit media items or folders. Solution: Install the latest version: * If you use the Media Folders module, upgrade to Media Folder 1.0.8 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * João Mauricio (jmauricio) [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [7] [1] https://www.drupal.org/project/media_folders [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/media_folders/releases/1.0.8 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/jmauricio [6] https://www.drupal.org/u/poker10 [7] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
by security-news＠drupal.org 15 Jul '26

15 Jul '26

View online: https://www.drupal.org/sa-core-2026-011 Project: Drupal core [1] Date: 2026-July-15 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: >=11.2.0 CVE IDs: CVE-2026-15917 Description: Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.4 [3]. * If you use Drupal 11.3.x, update to Drupal 11.3.14 [4]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening. Drupal 8 [5] and Drupal 9 [6] have both reached end-of-life. Reported By: * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Fixed By: * Shawn Duncan (fathershawn) [8] * Pierre Rudloff (prudloff) [9] of the Drupal Security Team Coordinated By: * catch (catch) [10] of the Drupal Security Team * Lee Rowlands (larowlan) [11] of the Drupal Security Team * Dave Long (longwave) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/11.4.4 [4] https://www.drupal.org/project/drupal/releases/11.3.14 [5] https://www.drupal.org/psa-2021-06-29 [6] https://www.drupal.org/psa-2023-11-01 [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/fathershawn [9] https://www.drupal.org/u/prudloff [10] https://www.drupal.org/u/catch [11] https://www.drupal.org/u/larowlan [12] https://www.drupal.org/u/longwave [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
by security-news＠drupal.org 15 Jul '26

15 Jul '26

View online: https://www.drupal.org/sa-core-2026-010 Project: Drupal core [1] Date: 2026-July-15 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-15916 Description: The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images. Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12) [3]). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.4 [4]. * If you use Drupal 11.3.x, update to Drupal 11.3.14 [5]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.13 [6]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [7] and Drupal 9 [8] have both reached end-of-life. Reported By: * offensive-ai [9] Fixed By: * Benji Fisher (benjifisher) [10] of the Drupal Security Team * Kim Pepper (kim.pepper) [11] * Mohit Aghera (mohit_aghera) [12] Coordinated By: * Benji Fisher (benjifisher) [13] of the Drupal Security Team * catch (catch) [14] of the Drupal Security Team * Lee Rowlands (larowlan) [15] of the Drupal Security Team * Juraj Nemec (poker10) [16] of the Drupal Security Team * Jess (xjm) [17] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [18] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/psa-2023-07-12 [4] https://www.drupal.org/project/drupal/releases/11.4.4 [5] https://www.drupal.org/project/drupal/releases/11.3.14 [6] https://www.drupal.org/project/drupal/releases/10.6.13 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/psa-2023-11-01 [9] https://www.drupal.org/u/offensive-ai [10] https://www.drupal.org/u/benjifisher [11] https://www.drupal.org/u/kimpepper [12] https://www.drupal.org/u/mohit_aghera [13] https://www.drupal.org/u/benjifisher [14] https://www.drupal.org/u/catch [15] https://www.drupal.org/u/larowlan [16] https://www.drupal.org/u/poker10 [17] https://www.drupal.org/u/xjm [18] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
by security-news＠drupal.org 15 Jul '26

15 Jul '26

View online: https://www.drupal.org/sa-core-2026-012 Project: Drupal core [1] Date: 2026-July-14 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-55805 Description: The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.4 [3]. * If you use Drupal 11.3.x, update to Drupal 11.3.14 [4]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.13 [5]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [6] and Drupal 9 [7] have both reached end-of-life. Reported By: * haii haii (hai27ii2o) [8] Fixed By: * danielveza [9] * Lee Rowlands (larowlan) [10] of the Drupal Security Team * Mingsong (mingsong) [11] provisional member of the Drupal Security Team * James Gilliland (neclimdul) [12] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [13] of the Drupal Security Team * Lee Rowlands (larowlan) [14] of the Drupal Security Team * Dave Long (longwave) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/11.4.4 [4] https://www.drupal.org/project/drupal/releases/11.3.14 [5] https://www.drupal.org/project/drupal/releases/10.6.13 [6] https://www.drupal.org/psa-2021-06-29 [7] https://www.drupal.org/psa-2023-11-01 [8] https://www.drupal.org/u/hai27ii2o [9] https://www.drupal.org/u/danielveza [10] https://www.drupal.org/u/larowlan [11] https://www.drupal.org/u/mingsong [12] https://www.drupal.org/u/neclimdul [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/larowlan [15] https://www.drupal.org/u/longwave [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-079 Project: Commerce guest registration [1] Date: 2026-July-08 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-15089 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/commerce_guest_registration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-078 Project: Clean RESTful [1] Date: 2026-July-08 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-15087 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/clean_node_api [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-077 Project: Raw Formatter [Meta Tag Formatter] [1] Date: 2026-July-08 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-15086 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/raw_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-076 Project: AI SEO/GEO Analyzer [1] Date: 2026-July-08 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site Scripting Affected versions: <1.1.3 CVE IDs: CVE-2026-15085 Description: The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users. The generated HTML was rendered without passing through Drupal's filtering pipeline, so it relied on the LLM output being safe. Under certain circumstances a crafted prompt injection — planted in content that is included in the analysis — can cause the LLM to emit markup that results in stored Cross-site Scripting when the report is later viewed. This vulnerability is mitigated by the fact that an attacker must be able to inject text into the content that is sent to the LLM, and that prompt injection is non-deterministic and not guaranteed to succeed on a given attempt. Solution: Install the latest version: * If you use the AI SEO/GEO Analyzer module 1.1.x, upgrade to ai_seo 1.1.3 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Juhani Väätäjä (j-vee) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185231-ai_seo-security/-/work_items/1 [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ai_seo [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_seo/releases/1.1.3 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/j-vee [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://git.drupalcode.org/security/185231-ai_seo-security/-/work_items/1 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-075 Project: UI Patterns (SDC in Drupal UI) [1] Date: 2026-July-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <2.0.17 CVE IDs: CVE-2026-15084 Description: This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC. The module doesn't sufficiently sanitize the markup passed to components under certain scenarios. This vulnerability is mitigated by the fact that an attacker must be able to create or update content rendered by UI Patterns. Solution: Install the latest version: * If you use the UI Patterns module on version 2, upgrade to UI Patterns 2.0.17 [3] Reported By: * Hervé Donner (herved) [4] Fixed By: * Florent Torregrosa (grimreaper) [5] * Hervé Donner (herved) [6] * Mikael Meulle (just_like_good_vibes) [7] * Pierre Dureau (pdureau) [8] Coordinated By: * Neil Drumm (drumm) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Dave Long (longwave) [12] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_item… [13] ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/ui_patterns [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ui_patterns/releases/2.0.17 [4] https://www.drupal.org/u/herved [5] https://www.drupal.org/u/grimreaper [6] https://www.drupal.org/u/herved [7] https://www.drupal.org/u/just_like_good_vibes [8] https://www.drupal.org/u/pdureau [9] https://www.drupal.org/u/drumm [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/longwave [13] https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_item… [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0