September 2026 - Security-news

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-191 Project: Diba carousel slider [1] Project machine name: diba_carousel Date: 2026-September-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting (XSS) Affected versions: <3.0.2 CVE IDs: CVE-2026-96382 Description: The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms. This vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the "Allow HTML description" option. Solution: Upgrade to the latest version: * If you are using Diba carousel slider 3.1.x, upgrade to Diba carousel slider 3.1.1. [3] * If you are using Diba carousel slider 3.0.x, upgrade to Diba carousel slider 3.0.2. [4] If you are unable to upgrade immediately, disable the "Allow HTML description" option in affected carousel blocks until the update can be applied. Reported By: * Kalle Kipinä (kekkis) [5] Fixed By: * Oriol Roselló Castells (oriol_e9g) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/diba_carousel [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/diba_carousel/releases/3.1.1 [4] https://www.drupal.org/project/diba_carousel/releases/3.0.2 [5] https://www.drupal.org/u/kekkis [6] https://www.drupal.org/u/oriol_e9g [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-190 Project: Smart Content [1] Project machine name: smart_content Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <3.2.1 CVE IDs: CVE-2026-96386 Description: This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint. This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed. Solution: Install the latest version: * Upgrade to Smart Content 3.2.1 [3]. Reported By: * Tin Nguyen Huu (s4m0y3d) [4] Fixed By: * Michael Lander (michaellander) [5] * Tin Nguyen Huu (s4m0y3d) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/smart_content [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/smart_content/releases/3.2.1 [4] https://www.drupal.org/u/s4m0y3d [5] https://www.drupal.org/u/michaellander [6] https://www.drupal.org/u/s4m0y3d [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-189 Project: CSS Usage Analyzer [1] Project machine name: css_usage_analyzer Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper access control Affected versions: >=1.0.0 <1.0.2 CVE IDs: CVE-2026-96380 Description: This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions. Solution: Install the latest version: * Upgrade to CSS Usage Analyzer 1.0.2 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Greg Knaddison (greggles) [5] of the Drupal Security Team * Marcus Johansson (marcus_johansson) [6] * Zeeshaan khann (zeeshan_khan) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/css_usage_analyzer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/css_usage_analyzer/releases/1.0.2 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/greggles [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/zeeshan_khan [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-188 Project: Combined image style [1] Project machine name: combined_image_style Date: 2026-September-23 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Improper access control Affected versions: <1.0.7 CVE IDs: CVE-2026-96377 Description: This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token, potentially leading to a denial of service. Sites are affected simply by having the module installed, even when no combined image styles are configured or in use. This vulnerability is mitigated by the fact that only public files can be targeted, and derivatives of private files are still protected by core's token check. Solution: Install the latest version: * If you use the Combined image style module, upgrade to Combined image style 1.0.7 [3]. Reported By: * Sven Decabooter (svendecabooter) [4] Fixed By: * Sven Decabooter (svendecabooter) [5] * Swan Kalata (akalata) [6] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/combined_image_style [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/combined_image_style/releases/1.0.7 [4] https://www.drupal.org/u/svendecabooter [5] https://www.drupal.org/u/svendecabooter [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-187 Project: AI CKEditor [1] Project machine name: ai_ckeditor Date: 2026-September-23 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Code execution via Twig templates Affected versions: <1.4.3 CVE IDs: CVE-2026-96392 Description: This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data. Solution: Install the latest version: * If you use the AI CKEditor module, upgrade to AI CKEditor 1.4.3 [3]. Reported By: * Stef Rouschop (stefro) [4] Fixed By: * Artem Dmitriiev (a.dmitriiev) [5] * Marcus Johansson (marcus_johansson) [6] * Stef Rouschop (stefro) [7] Coordinated By: * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/ai_ckeditor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_ckeditor/releases/1.4.3 [4] https://www.drupal.org/u/stefro [5] https://www.drupal.org/u/admitriiev [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/stefro [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/longwave [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-186 Project: Webform REST [1] Project machine name: webform_rest Date: 2026-September-23 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.2.1 CVE IDs: CVE-2026-96391 Description: This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields. Solution: Install the latest version: * Upgrade to Webform REST 4.2.1 [3]. The 4.1.x branch is no longer supported. Reported By: * Lauri (laurii) [4] Fixed By: * Adam Bramley (acbramley) [5] * Miguel Ferreira (miguelpamferreira) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * cilefen (cilefen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [10], provisional member of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/webform_rest [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform_rest/releases/4.2.1 [4] https://www.drupal.org/u/laurii [5] https://www.drupal.org/u/acbramley [6] https://www.drupal.org/u/miguelpamferreira [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/cilefen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mohit_aghera [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-185 Project: Editoria11y Accessibility Checker [1] Project machine name: editoria11y Date: 2026-September-23 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.2.23 || >=3.0.0 <3.0.9 CVE IDs: CVE-2026-96390 Description: This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass. Solution: If you use the Editoria11y module, update the module and *review permissions*. * If you use the Editoria11y module version 2.2.x, upgrade to editoria11y 2.2.23 [3]. * If you use the Editoria11y module version 3.0.x, upgrade to editoria11y 3.0.9 [4]. *Review permissions:* Make sure anonymous or untrusted authenticated users have not been given permission to use the checker. The permission is labeled as: * /View Editoria11y checker/ up to and including 2.2.22/3.0.8, and * /Run Editoria11y checker and report results/ with 2.2.23/3.0.9. Reported By: * Maksim Hayder (tr_jan) [5] Fixed By: * Brian Osborne (bkosborne) [6] * John Jameson (itmaybejj) [7] * Jason Partyka (partyka) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/editoria11y [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/editoria11y/releases/2.2.23 [4] https://www.drupal.org/project/editoria11y/releases/3.0.9 [5] https://www.drupal.org/u/tr_jan [6] https://www.drupal.org/u/bkosborne [7] https://www.drupal.org/u/itmaybejj [8] https://www.drupal.org/u/partyka [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-184 Project: Tawk.to - Live chat application [1] Project machine name: tawk_to Date: 2026-September-23 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <3.0.4 CVE IDs: CVE-2026-96388 Description: This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability. Solution: Install the latest version: * Upgrade to tawk.to 3.0.4 [3]. After updating, clear the Drupal cache. Reported By: * Tin Nguyen Huu (s4m0y3d) [4] Fixed By: * Andriy Khomych (andriy khomych) [5] * Tin Nguyen Huu (s4m0y3d) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Damien McKenna (damienmckenna) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/tawk_to [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tawk_to/releases/3.0.4 [4] https://www.drupal.org/u/s4m0y3d [5] https://www.drupal.org/u/andriy-khomych [6] https://www.drupal.org/u/s4m0y3d [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/damienmckenna [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-183 Project: Stop administrator login [1] Project machine name: stop_admin Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=1.0 <1.6 CVE IDs: CVE-2026-96387 Description: This module enables sites to block access for the administrative user account (user 1) or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be able to authenticate through certain alternative authentication methods. This vulnerability is mitigated by the fact that an attacker must possess valid credentials for a user with the administrator role, and must authenticate using a less commonly used authentication mechanism. Solution: Install the latest version: * If you use the Stop Administrator Login module, upgrade to Stop Administrator Login 8.x-1.6 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Bram Driesen (bramdriesen) [5] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/stop_admin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/stop_admin/releases/8.x-1.6 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/bramdriesen [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-182 Project: REST & JSON API Authentication for Drupal [1] Project machine name: rest_api_authentication Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <3.2.0 CVE IDs: CVE-2026-96385 Description: This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability. Solution: Install the latest version: * Upgrade to REST & JSON API Authentication 3.2.0 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Drew Webber (mcdruid) [5] of the Drupal Security Team * purva_shende [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Heine Deelstra (heine) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/rest_api_authentication [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/rest_api_authentication/releases/3.2.0 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/purva_shende [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/heine [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0