August 2026 - Security-news - lists.drupal.org

Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-107 Project: Content Moderation Notifications [1] Date: 2026-August-26 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.9.0 CVE IDs: CVE-2026-81161 Description: The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted. A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators. Solution: Install the latest version: * If you use Content Moderation Notifications, upgrade to version 8.x-3.9 [3]. * Review roles to ensure only trusted roles have access to the "administer content moderation notifications" permission. changed. Reported By: * Lee Rowlands (larowlan) [4] of the Drupal Security Team * Luke Leber (luke.leber) [5] Fixed By: * Brian Osborne (bkosborne) [6] * Jonathan Hedstrom (jhedstrom) [7] * Luke Leber (luke.leber) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Lee Rowlands (larowlan) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/content_moderation_notifications [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/content_moderation_notifications/releases/8.… [4] https://www.drupal.org/u/larowlan [5] https://www.drupal.org/u/lukeleber [6] https://www.drupal.org/u/bkosborne [7] https://www.drupal.org/u/jhedstrom [8] https://www.drupal.org/u/lukeleber [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/larowlan [12] https://www.drupal.org/u/poker10 [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-106 Project: Commerce CyberSource [1] Date: 2026-August-26 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Insufficient input validation Affected versions: <1.10.0 CVE IDs: CVE-2026-81159 Description: This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. This issue only affects the Secure Acceptance Hosted Checkout gateway integration. Solution: Install the latest version: * If you use the Commerce CyberSource module, upgrade to Commerce CyberSource 8.x-1.10 [3]. Reported By: * Brian Willows [4] Fixed By: * Adrian M. (adrianandres) [5] * Ryan Szrama (rszrama) [6] * Vitaliy Marchuk (vmarchuk) [7] Coordinated By: * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Heine Deelstra (heine) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/commerce_cybersource [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_cybersource/releases/8.x-1.10 [4] https://www.drupal.org/u/brian-willows [5] https://www.drupal.org/u/adrianandres [6] https://www.drupal.org/u/rszrama [7] https://www.drupal.org/u/vmarchuk [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/heine [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-105 Project: CAPTCHA Protected Page [1] Date: 2026-August-26 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Cookie Forgery Affected versions: <1.0.2 CVE IDs: CVE-2026-81168 Description: This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirely. Solution: Install the latest version: * If you use the CAPTCHA Protected Page module, upgrade to CAPTCHA Protected Page 1.0.2 [3]. Reported By: * lovasoa [4] Fixed By: * Carlo Miguel Agno (carlagno) [5] * Mark Jayson Gruta (mjgruta) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Carlo Miguel Agno (carlagno) [8] * Greg Knaddison (greggles) [9] of the Drupal Security Team * Heine Deelstra (heine) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/captcha_protected_page [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/captcha_protected_page/releases/1.0.2 [4] https://www.drupal.org/u/lovasoa [5] https://www.drupal.org/u/carlagno [6] https://www.drupal.org/u/mjgruta [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/carlagno [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/heine [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-104 Project: Blazy [1] Date: 2026-August-26 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <3.0.18 CVE IDs: CVE-2026-81165 Description: This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view. The issue is mitigated by the fact that the shortcode does not expose the entire entity. Only fields that the shortcode can render are vulnerable. Solution: Install the latest version: * If you use the Blazy module for Drupal, upgrade to Blazy 3.0.18 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Gaus Surahman (gausarts) [5] * Drew Webber (mcdruid) [6] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/blazy [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/blazy/releases/3.0.18 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/gausarts [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103
by security-news＠drupal.org 26 Aug '26

26 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-103 Project: Address Suggestion [1] Date: 2026-August-26 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.0.25 CVE IDs: CVE-2026-81167 Description: The Address Suggestion module provides address autocomplete functionality using configured address providers. The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to inject malicious content into data returned by a configured address provider, and a user must perform a search that returns the malicious suggestion. Solution: Install the latest version: * If you use the address_suggestion module, upgrade to address_suggestion 1.0.25 [3]. Reported By: * Conrad Lara (cmlara) [4] Fixed By: * Conrad Lara (cmlara) [5] * Joseph Olstad (joseph.olstad) [6] * NGUYEN Bao (lazzyvn) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/address_suggestion [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/address_suggestion/releases/1.0.25 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/josepholstad [7] https://www.drupal.org/u/lazzyvn [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
by security-news＠drupal.org 19 Aug '26

19 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-102 Project: Screenshot [1] Date: 2026-August-19 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-76759 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Conrad Lara (cmlara) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Heine Deelstra (heine) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/screenshot [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/heine [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101
by security-news＠drupal.org 19 Aug '26

19 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-101 Project: Link content parser [1] Date: 2026-August-19 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-76758 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Coordinated By: * Heine Deelstra (heine) [5] of the Drupal Security Team * Drew Webber (mcdruid) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/postlight_parser [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/heine [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
by security-news＠drupal.org 19 Aug '26

19 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-100 Project: Gammu SMS Daemon [1] Date: 2026-August-19 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-76755CVE-2026-76756CVE-2026-76757 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Coordinated By: * Greg Knaddison (greggles) [5] of the Drupal Security Team * Heine Deelstra (heine) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/gammu_smsd [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/greggles [6] https://www.drupal.org/u/heine [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-099 Project: Quick Tabs [1] Date: 2026-August-12 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.3.1 CVE IDs: CVE-2026-73477 Description: This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and performed no access check for reusable custom blocks. Content that should have been denied was therefore rendered — for example, an unpublished node or unpublished reusable custom block could be shown to users without permission to view it. The access bypass is mitigated by the fact that affected content is selected by a user with the “administer quicktabs” permission when the tab is configured, so an attacker cannot choose which content is exposed. Solution: Install the latest version: * If you use the Quick Tabs module for Drupal, upgrade to Quick Tabs 4.3.1 [3] Reported By: * Joël Pittet (joelpittet) [4] Fixed By: * Joël Pittet (joelpittet) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/quicktabs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/quicktabs/releases/4.3.1 [4] https://www.drupal.org/u/joelpittet [5] https://www.drupal.org/u/joelpittet [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-098 Project: External Authentication [1] Date: 2026-August-12 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.0.13 CVE IDs: CVE-2026-73476 Description: This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This vulnerability is mitigated by the fact that it affects only sites using impacted MySQL or MariaDB collation settings for the module’s authentication mapping storage. Solution: Install the latest version: * If you use the externalauth module for Drupal, upgrade to 2.0.13 [3] Reported By: * 晉宇林 (whale120) [4] Fixed By: * Sven Decabooter (svendecabooter) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/externalauth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/externalauth/releases/2.0.13 [4] https://www.drupal.org/u/whale120 [5] https://www.drupal.org/u/svendecabooter [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0