August 2026 - Security-news - lists.drupal.org

Entity Share Websub - Critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-097 Project: Entity Share Websub [1] Date: 2026-August-12 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:None/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: Server-side request forgery (SSRF) Affected versions: <1.1.2 CVE IDs: CVE-2026-73474 Description: This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks. Solution: Install the latest version: * If you use the Entity Share Websub module for Drupal 9.x or 10.x, upgrade to Entity Share Websub 1.1.2 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Shawn Duncan (fathershawn) [5] * Jeffrey S. Mattson (jeffreysmattson) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/entity_share_websub [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_share_websub/releases/1.1.2 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/fathershawn [6] https://www.drupal.org/u/jeffreysmattson [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-096 Project: Diff [1] Date: 2026-August-12 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.1 || >=2.1.0 <2.1.1 CVE IDs: CVE-2026-73478 Description: This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission view the entity. Solution: Install the latest version: * If you use the Diff module, upgrade to Diff 2.1.1 [3] or Diff 2.0.1 [4] Reported By: * Alexei Rayu (alexrayu) [5] Fixed By: * Adam Bramley (acbramley) [6] * Derek Wright (dww) [7] * Lee Rowlands (larowlan) [8] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Lee Rowlands (larowlan) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/diff [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/diff/releases/2.1.1 [4] https://www.drupal.org/project/diff/releases/2.0.1 [5] https://www.drupal.org/u/alexrayu [6] https://www.drupal.org/u/acbramley [7] https://www.drupal.org/u/dww [8] https://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/larowlan [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-095 Project: Commerce PayPal [1] Date: 2026-August-12 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.12.0 || >=2.1.0 <2.1.3 || 2.0.* CVE IDs: CVE-2026-73475 Description: This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link payment gateway. Solution: * If you use the Commerce Paypal module for Drupal, upgrade to Commerce Paypal 2.1.3 [3] or Commerce Paypal 8.x-1.12 [4] Reported By: * Kimberley Massey (kimberleycgm) [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] * Kimberley Massey (kimberleycgm) [7] * Ryan Szrama (rszrama) [8] * Tom Ashe (tomtech) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Benji Fisher (benjifisher) [11] of the Drupal Security Team * Neil Drumm (drumm) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/commerce_paypal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_paypal/releases/2.1.3 [4] https://www.drupal.org/project/commerce_paypal/releases/8.x-1.12 [5] https://www.drupal.org/u/kimberleycgm [6] https://www.drupal.org/u/jsacksick [7] https://www.drupal.org/u/kimberleycgm [8] https://www.drupal.org/u/rszrama [9] https://www.drupal.org/u/tomtech [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/benjifisher [12] https://www.drupal.org/u/drumm [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/poker10 [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
by security-news＠drupal.org 05 Aug '26

05 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-094 Project: Entity Browser [1] Date: 2026-August-05 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Affected versions: <2.16.0 CVE IDs: CVE-2026-18986 Description: The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser. Solution: Install the latest version: * If you use the Entity Browser module, upgrade to Entity Browser 8.x-2.16 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Julian Pustkuchen (anybody) [5] * Sascha Grossenbacher (berdir) [6] * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/entity_browser [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_browser/releases/8.x-2.16 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/berdir [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
by security-news＠drupal.org 05 Aug '26

05 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-093 Project: Edit in-place field [1] Date: 2026-August-05 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.1 CVE IDs: CVE-2026-18985 Description: This module provides formatters to allow in-place editing in a View or other display (full content, teaser...). The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission". Solution: Install the latest version: * If you use the Edit in-place field module for Drupal, upgrade to 2.1.1 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Bálint Nagy (nagy.balint) [5] Coordinated By: * Neil Drumm (drumm) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/edit_in_place_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/edit_in_place_field/releases/2.1.1 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/nagybalint [6] https://www.drupal.org/u/drumm [7] https://www.drupal.org/u/greggles [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0