July 2026 - Security-news - lists.drupal.org

ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-074 Project: ECA: Event - Condition - Action [1] Date: 2026-July-08 Security risk: *Less critical* 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.1.20 || >=3.0.0 <3.0.12 || >=3.1.0 <3.1.4 CVE IDs: CVE-2026-15083 Description: The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is mitigated by the fact that a site must be running an ECA model that uses the "Render: Twig" action on a data flow. Solution: Install the latest version: * If you use the ECA 3.1 for Drupal 10.x or 11.x, upgrade to ECA 3.1.4 [3] * If you use the ECA 3.0 for Drupal 10.x or 11.x, upgrade to ECA 3.0.12 [4] * If you use the ECA 1.2 for Drupal 10.x or 11.x, upgrade to ECA 2.1.20 [5] Reported By: * Changhai Qi (qichanghai) [6] Fixed By: * Jürgen Haas (jurgenhaas) [7] Coordinated By: * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/eca [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3609312 [4] https://www.drupal.org/node/3609311 [5] https://www.drupal.org/node/3609310 [6] https://www.drupal.org/u/qichanghai [7] https://www.drupal.org/u/jurgenhaas [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/longwave [11] https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-073 Project: Siteimprove Analytics [1] Date: 2026-July-08 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <2.0.1 CVE IDs: CVE-2026-15082 Description: The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer siteimprove_analytics". Solution: Install the latest version: * If you use the siteimprove_analytics module for Drupal verision prior 10.3, upgrade to siteimprove_analytics 2.0.1 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Bohdan Artemchuk (bohart) [5] * Andriy Parkhomiuk (grask0) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/siteimprove_analytics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/siteimprove_analytics/releases/2.0.1 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/bohart [6] https://www.drupal.org/u/grask0 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/prudloff [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-072 Project: Location Selector [1] Date: 2026-July-08 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: SQL Injection Affected versions: <1.3.0 CVE IDs: CVE-2026-15081 Description: The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist that uses the affected filter and is configured to accept user input. Solution: Install the latest version: * If you use the Location Selector module for Drupal, upgrade to Location Selector 8.x-1.3 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * handkerchief [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185258-location_selector-security/-/wor… [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/location_selector [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/location_selector/releases/8.x-1.3 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/handkerchief [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10 [9] https://git.drupalcode.org/security/185258-location_selector-security/-/wor… [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-071 Project: Ray Enterprise Translation [1] Date: 2026-July-08 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site request forgery Affected versions: <4.0.4 || >=4.1.0 <4.1.4 || >=11.0.0 <11.0.4 CVE IDs: CVE-2026-15080 Description: The Lingotek Ray Enterprise Translation provides multilingual site management. The module fails to protect several state-changing administrative routes against Cross Site Request Forgery attacks. An attacker could trick a privileged user into visiting a crafted page that triggers actions such as updating callback settings, uploading or downloading translations, or changing translation state. Solution: Install the latest version appropriate for your site * If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 11.0.4 [3] * If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 4.1.4 [4] * If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 4.0.4 [5] Reported By: * Pierre Rudloff (prudloff) [6] of the Drupal Security Team Fixed By: * Naresh Bavaskar (naresh_bavaskar) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/lingotek [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/lingotek/releases/11.0.4 [4] https://www.drupal.org/project/lingotek/releases/4.1.4 [5] https://www.drupal.org//www.drupal.org/project/lingotek/releases/4.0.4 [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/naresh_bavaskar [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-070 Project: Login Disable [1] Date: 2026-July-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.4 CVE IDs: CVE-2026-15079 Description: The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to the end of the login form page. The module doesn't sufficiently protect the disabled login form from brute force attacks. Depending on the length of the key this could allow an attacker to use a brute force attack to bypass the protection provided by this module. The security fix blocks these attempts with flood control. This vulnerability is mitigated by the fact that an attacker must obtain a valid username & password. Solution: Install the latest version: * If you use the Login Disable module, upgrade to Login Disable 2.1.4 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Boris Doesborg (batigolix) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/login_disable [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/login_disable/releases/2.1.4 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/batigolix [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/prudloff [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-069 Project: Colorbox [1] Date: 2026-July-01 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: < 2.1.5 || 2.2.0 CVE IDs: CVE-2026-58591 Description: The Colorbox module integrates with the Colorbox JavaScript library to display content in an overlay above the page. The module doesn't sufficiently protect against injection of malicious JavaScript under certain scenarios. This vulnerability is mitigated by the fact that an attacker must have a role that permits them to enter HTML content. Solution: Install the latest version: * If you use Colorbox 2.1.x, upgrade to: Colorbox 2.1.5 [3] * If you use Colorbox 2.2.x, upgrade to: Colorbox 2.2.1 [4] Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Paul McKibben (paulmckibben) [6] Coordinated By: * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185155-colorbox-security/-/work_items/1 [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/colorbox [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/colorbox/releases/2.1.5 [4] https://www.drupal.org/project/colorbox/releases/2.2.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/paulmckibben [7] https://www.drupal.org/u/prudloff [8] https://git.drupalcode.org/security/185155-colorbox-security/-/work_items/1 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-068 Project: FlowDrop [1] Date: 2026-July-01 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-58590 Description: This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the user. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer FlowDrop workflows" (or the equivalent "Create FlowDrop workflows" / "Edit FlowDrop workflows" permissions). Solution: Install the latest version: * If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0 [3] Reported By: * Aincient Labs (aincient labs) [4] Fixed By: * Shibin Das (d34dman) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Dave Long (longwave) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3592075-flowdrop-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/flowdrop [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/flowdrop/releases/1.6.0 [4] https://www.drupal.org/u/aincient-labs [5] https://www.drupal.org/u/d34dman [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/longwave [10] https://git.drupalcode.org/security/3592075-flowdrop-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-067 Project: FlowDrop [1] Date: 2026-July-01 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-58589 Description: This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution (incurring LLM spend and tool side effects) or send messages into other user's sessions. This vulnerability is mitigated by the fact that an attacker must have the permission "View any session", which is not granted to anonymous or authenticated users by default. Solution: Install the latest version: * If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0 [3] Driving a session now additionally requires the "Execute session workflow" permission. Reported By: * Aincient Labs (aincient labs) [4] Fixed By: * Shibin Das (d34dman) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Dave Long (longwave) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3592076-flowdrop-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/flowdrop [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/flowdrop/releases/1.6.0 [4] https://www.drupal.org/u/aincient-labs [5] https://www.drupal.org/u/d34dman [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/longwave [10] https://git.drupalcode.org/security/3592076-flowdrop-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-066 Project: Drupal Canvas [1] Date: 2026-July-01 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper validation Affected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1 CVE IDs: CVE-2026-58588 Description: The Canvas module allow you to upload image files via a custom API. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior. Solution: Install the latest version: * If you use the 1.4.1 version of Canvas, upgrade to 1.4.2 [3] * If you use the 1.5.1 version of Canvas, upgrade to 1.5.2 [4] * If you use the 1.6.0 version of Canvas, upgrade to 1.6.1 [5] * If you use the 1.7.0 version of Canvas, upgrade to 1.7.1 [6] Reported By: * Christian López Espínola (penyaskito) [7] Fixed By: * AKHIL BABU (akhil babu) [8] * Christian López Espínola (penyaskito) [9] Coordinated By: * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/canvas [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/canvas/releases/1.4.2 [4] https://www.drupal.org/project/canvas/releases/1.5.2 [5] https://www.drupal.org/project/canvas/releases/1.6.1 [6] https://www.drupal.org/project/canvas/releases/1.7.1 [7] https://www.drupal.org/u/penyaskito [8] https://www.drupal.org/u/akhil-babu [9] https://www.drupal.org/u/penyaskito [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-065 Project: Drupal Canvas [1] Date: 2026-July-01 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper validation Affected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1 CVE IDs: CVE-2026-58587 Description: The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat. These file uploads are insufficiently validated before being written to Drupal's temporary directory. In some cases, this may lead to cross-site scripting (XSS). Solution: Install the latest version: * If you use the 1.4.1 version of Canvas, upgrade to 1.4.2 [3] * If you use the 1.5.1 version of Canvas, upgrade to 1.5.2 [4] * If you use the 1.6.0 version of Canvas, upgrade to 1.6.1 [5] * If you use the 1.7.0 version of Canvas, upgrade to 1.7.1 [6] Reported By: * AKHIL BABU (akhil babu) [7] Fixed By: * Alex Bronstein (effulgentsia) [8] of the Drupal Security Team * Christian López Espínola (penyaskito) [9] Coordinated By: * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3591755-canvas-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/canvas [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/canvas/releases/1.4.2 [4] https://www.drupal.org/project/canvas/releases/1.5.2 [5] https://www.drupal.org/project/canvas/releases/1.6.1 [6] https://www.drupal.org/project/canvas/releases/1.7.1 [7] https://www.drupal.org/u/akhil-babu [8] https://www.drupal.org/u/effulgentsia [9] https://www.drupal.org/u/penyaskito [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/3591755-canvas-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0