August 2026 - Security-news - lists.drupal.org

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-116 Project: Monster Menus [1] Date: 2026-August-26 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site Scripting Affected versions: <9.5.3 CVE IDs: CVE-2026-81201 Description: This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user’s session. This vulnerability is mitigated by the fact that an attacker must have the ability to create pages whose page title supports HTML. Solution: Install the latest version: * If you use the Monster Menus module, upgrade to monster_menus 9.5.3 [3]. Reported By: * Dan Wilga (gribnif) [4] Fixed By: * Dan Wilga (gribnif) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/monster_menus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/monster_menus/releases/9.5.3 [4] https://www.drupal.org/u/gribnif [5] https://www.drupal.org/u/gribnif [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-117 Project: Slick Carousel [1] Date: 2026-August-26 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <2.1.0 CVE IDs: CVE-2026-81160 Description: Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting (XSS) vulnerability. /Note: This vulnerability was fixed in 8.x-2.1 but that was not marked as a security release at the time./ Solution: * Only the 3.0.x branch is supported by the maintainers. Upgrade to a release on that branch. Reported By: * Drew Webber (mcdruid) [3] of the Drupal Security Team Fixed By: * Gaus Surahman (gausarts) [4] Coordinated By: * Swan Kalata (akalata) [5] of the Drupal Security Team * cilefen [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/slick [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/u/mcdruid [4] https://www.drupal.org/u/gausarts [5] https://www.drupal.org/u/akalata [6] https://www.drupal.org/u/cilefen [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-115 Project: LDAP / Active Directory Integration [1] Date: 2026-August-26 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Proof/TD:All [2] Vulnerability: Information Disclosure Affected versions: <2.2.1 CVE IDs: CVE-2026-81205 Description: This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to. Solution: Install the latest version: * If you use the LDAP / Active Directory Integration module, upgrade to LDAP / Active Directory Integration 2.2.1 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Harshvardhan Soni (sharsh) [5] * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/ldap_auth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ldap_auth/releases/2.2.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/sharsh [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-114 Project: Entity PDF [1] Date: 2026-August-26 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.5 CVE IDs: CVE-2026-81164 Description: The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view. Solution: Install the latest version: * If you use the Entity PDF module for Drupal upgrade to Entity PDF 2.1.5 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Italo Mairo (itamair) [5] * Wesley Sandra (weseze) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/entity_pdf [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_pdf/releases/2.1.5 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/itamair [6] https://www.drupal.org/u/weseze [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-113 Project: Entity API [1] Date: 2026-August-26 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Affected versions: <1.8.0 CVE IDs: CVE-2026-81158 Description: The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module. Solution: Install the latest version: * If you use the Entity API module, upgrade to Entity API 8.x-1.8 [3]. Reported By: * Douglas Groene (dgroene) [4] * Matt Glaman (mglaman) [5] Fixed By: * Sascha Grossenbacher (berdir) [6] * Klaus Purer (klausi) [7] * Matt Glaman (mglaman) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Lee Rowlands (larowlan) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/entity [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity/releases/8.x-1.8 [4] https://www.drupal.org/u/dgroene [5] https://www.drupal.org/u/mglaman [6] https://www.drupal.org/u/berdir [7] https://www.drupal.org/u/klausi [8] https://www.drupal.org/u/mglaman [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/larowlan [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-112 Project: DXPR Builder: The AI Visual Page Builder for Drupal [1] Date: 2026-August-26 Security risk: *Moderately critical* 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <2.8.1 CVE IDs: CVE-2026-81162 Description: The DXPR Builder [3] module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via drupalSettings. This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token. Solution: Install the latest version: * If you use the 2.x branch of the DXPR Builder module, upgrade to DXPR Builder 2.8.1 or later [4]. * The 3.x branch is not affected as it proxies AI requests through the contributed AI [5] module. Reported By: * jurriaanroelofs [6] Fixed By: * jurriaanroelofs [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/dxpr_builder [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/dxpr_builder [4] https://www.drupal.org/project/dxpr_builder/releases/2.8.1 [5] https://www.drupal.org/project/ai [6] https://www.drupal.org/u/jurriaanroelofs [7] https://www.drupal.org/u/jurriaanroelofs [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-111 Project: Disable Login Page [1] Date: 2026-August-26 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:None/II:None/E:Proof/TD:All [2] Vulnerability: Access bypass Affected versions: <= 1.1.4 CVE IDs: CVE-2026-81269 Description: This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared. An attacker may continue to access the login page despite the restriction having been enabled. Solution: Install the latest version: * If you use the Disable Login Page module, upgrade to Disable Login Page 1.1.4 [3]. Reported By: * Brian Osborne (bkosborne) [4] * Jason Partyka (partyka) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/disable_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3619254 [4] https://www.drupal.org/u/bkosborne [5] https://www.drupal.org/u/partyka [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-110 Project: Disable Login Page [1] Date: 2026-August-26 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <= 1.1.4 CVE IDs: CVE-2026-18260 Description: This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism. Solution: Install the latest version: * If you use the Disable Login Page module, upgrade to Disable Login Page 1.1.4 [3]. Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Brian Osborne (bkosborne) [5] Coordinated By: * Neil Drumm (drumm) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/disable_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3619254 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/bkosborne [6] https://www.drupal.org/u/drumm [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-109 Project: Digital Signage Framework [1] Date: 2026-August-26 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.6.1 CVE IDs: CVE-2026-81166 Description: The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous visitor could read the rendered content of blocks they were not meant to see. This vulnerability is mitigated by the fact that many block plugins perform their own access checks on the content they display, which limits what can be disclosed through this route. Solution: Install the latest version: * If you use Digital Signage Framework 2.6.x, update to 2.6.1 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Daniel Speicher (danielspeicher) [5] * Jürgen Haas (jurgenhaas) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/digital_signage_framework [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/digital_signage_framework/releases/2.6.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/danielspeicher [6] https://www.drupal.org/u/jurgenhaas [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-108 Project: Data field [1] Date: 2026-August-26 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <2.0.13 CVE IDs: CVE-2026-81269 Description: This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content. Solution: Install the latest version: * If you use the Data Field module, upgrade to Data Field 2.0.13 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] * Drew Webber (mcdruid) [5] of the Drupal Security Team * Steven Jones (steven jones) [6] Fixed By: * Joseph Olstad (joseph.olstad) [7] * NGUYEN Bao (lazzyvn) [8] * Marcus Johansson (marcus_johansson) [9] * Steven Jones (steven jones) [10] Coordinated By: * Swan Kalata (akalata) [11] of the Drupal Security Team * David Stoline (dstol) [12] * Greg Knaddison (greggles) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/datafield [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/datafield/releases/2.0.13 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/steven-jones [7] https://www.drupal.org/u/josepholstad [8] https://www.drupal.org/u/lazzyvn [9] https://www.drupal.org/u/marcus_johansson [10] https://www.drupal.org/u/steven-jones [11] https://www.drupal.org/u/akalata [12] https://www.drupal.org/u/dstol [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0