September 2026 - Security-news

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-166 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96371 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation or editing permissions to enter source configuration that is rendered unsafely. This vulnerability is mitigated by the fact that an attacker must have permission to create or edit webforms. Solution: Install the latest version. * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Dan Chadwick (danchadwick) [6] * Jacob Rockowitz (jrockowitz) [7] * Lee Rowlands (larowlan) [8] of the Drupal Security Team * Liam Morland (liam morland) [9] * Juraj Nemec (poker10) [10] of the Drupal Security Team * Pierre Rudloff (prudloff) [11] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * cilefen (cilefen) [14] of the Drupal Security Team * Damien McKenna (damienmckenna) [15] of the Drupal Security Team * Greg Knaddison (greggles) [16] of the Drupal Security Team * Jess (xjm) [17] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [18] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/danchadwick [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/liam-morland [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/prudloff [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/cilefen [15] https://www.drupal.org/u/damienmckenna [16] https://www.drupal.org/u/greggles [17] https://www.drupal.org/u/xjm [18] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-167 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96372 Description: The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update adds the /Administer webform remote post URLs/ permission. Review this permission and ensure it is granted only to trusted roles. The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.11 [4]. Review the new permission /Administer webform remote post URLs/ and ensure it is only granted to trusted roles. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team * Wesley Giles (seraphdev) [6] Fixed By: * Dan Chadwick (danchadwick) [7] * Jacob Rockowitz (jrockowitz) [8] * Liam Morland (liam morland) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Lee Rowlands (larowlan) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Pierre Rudloff (prudloff) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.11 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/seraphdev [7] https://www.drupal.org/u/danchadwick [8] https://www.drupal.org/u/jrockowitz [9] https://www.drupal.org/u/liam-morland [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/larowlan [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/prudloff [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-173 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96398 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more permissive view mode and see fields that would otherwise be restricted. This vulnerability is mitigated by the fact that an attacker must already have access to view the affected submission. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Mustafa Ahmed (mustafa007) [5] Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Mustafa Ahmed (mustafa007) [7] Coordinated By: * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * cilefen (cilefen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/mustafa007 [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/mustafa007 [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/cilefen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-174 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96356 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended to grant submission access only to selected user accounts could also grant access to anonymous users. This vulnerability is mitigated by the fact that the bypass depends on malformed saved access-rule configuration. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Adam Bramley (acbramley) [5] * enyug [6] Fixed By: * Jacob Rockowitz (jrockowitz) [7] * Liam Morland (liam morland) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * cilefen (cilefen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Lee Rowlands (larowlan) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/acbramley [6] https://www.drupal.org/u/enyug [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/liam-morland [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/cilefen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/larowlan [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-175 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Critical* 18 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96355 Description: The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution. This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Michael Maturi (michaelmaturi) [5] Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Liam Morland (liam morland) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/michaelmaturi [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/liam-morland [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-168 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96373 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view submission results for one webform may be able to access or remove files from the configured export temporary directory that were not generated for that webform. This vulnerability is mitigated by the fact that an attacker must have access to view submission results for a webform and must know or be able to determine a target filename. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Jacob Rockowitz (jrockowitz) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/prudloff [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Upcoming critical contributed project security release on September 23, 2026 - PSA-2026-09-21
by security-news＠drupal.org 21 Sep '26

21 Sep '26

View online: https://www.drupal.org/psa-2026-09-21 Date: 2026-September-21 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [1] Description: There will be a security release for a widely used contributed module on *September 23, 2026 between 17:00 and 21:00 UTC*. We are announcing this release in advance because the affected contributed module is used on a significant portion of Drupal sites, and the upcoming release will include a significant number of advisories. The advisory with the highest risk score for the release is currently rated as *critical*. Drupal core is not affected. .. Advisories may be published in batches (a few at a time) The current rate of advisories may require changes to our practices going forward: * The security team may publish advisories individually, at different times inside the window. * We will try to publish batches grouped by module. * We will announce in Slack when all planned releases for the day are complete. * We will release mailing list emails about the security updates together at the end of the window, to reduce the risk of site owners updating multiple times while advisories are still being published. These changes are intended to make the process easier for the team and to make communication from the team easier to follow. .. No special release procedures The planned update does not require special release procedures. Coordinated By: * Bram Driesen (bramdriesen) [2] of the Drupal Security Team * Damien McKenna (damienmckenna) [3] of the Drupal Security Team * Greg Knaddison (greggles) [4] of the Drupal Security Team * Dave Long (longwave) [5] of the Drupal Security Team * Moshe Weitzman (moshe weitzman) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/security-team/risk-levels [2] https://www.drupal.org/u/bramdriesen [3] https://www.drupal.org/u/damienmckenna [4] https://www.drupal.org/u/greggles [5] https://www.drupal.org/u/longwave [6] https://www.drupal.org/u/moshe-weitzman [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
by security-news＠drupal.org 16 Sep '26

16 Sep '26

View online: https://www.drupal.org/sa-core-2026-013 Project: Drupal core [1] Project machine name: drupal Date: 2026-September-16 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Third-party libraries Affected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7 Description: The Drupal project uses the CKEditor [3] library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal [4]. Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's security advisory: * High-severity Cross-site scripting (XSS) in the engine package [5] Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.7 [6]. * If you use Drupal 11.3.x, update to Drupal 11.3.17 [7]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.17 [8]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Note that Drupal 8 [9] and Drupal 9 [10] have both reached end-of-life. .... Instructions for contributed modules Site owners should also review their site following the protocol for managing external libraries and plugins [11], as contributed projects may use additional CKEditor plugins not packaged in Drupal core. CKEditor has also released another CVE in today's release that does not affect Drupal, but may affect custom plugins or other usecases: * Low-severity Cross-site scripting (XSS) in the engine package [12] Reported By: * Piotrek Koszuliński (Reinmar) [13] Fixed By: * catch (catch) [14] of the Drupal Security Team * Lee Rowlands (larowlan) [15] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [16], provisional member of the Drupal Security Team * Jess (xjm) [17] of the Drupal Security Team Coordinated By: * Bram Driesen (bramdriesen) [18] of the Drupal Security Team * catch (catch) [19] of the Drupal Security Team * Greg Knaddison (greggles) [20] of the Drupal Security Team * Lee Rowlands (larowlan) [21] of the Drupal Security Team * Dave Long (longwave) [22] of the Drupal Security Team * Jess (xjm) [23] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [24] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor5 [4] https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5f… [5] https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5f… [6] https://www.drupal.org/project/drupal/releases/11.4.7 [7] https://www.drupal.org/project/drupal/releases/11.3.17 [8] https://www.drupal.org/project/drupal/releases/10.6.17 [9] https://www.drupal.org/psa-2021-06-29 [10] https://www.drupal.org/psa-2023-11-01 [11] https://www.drupal.org/psa-2011-002 [12] https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gm… [13] https://www.drupal.org/u/reinmar [14] https://www.drupal.org/u/catch [15] https://www.drupal.org/u/larowlan [16] https://www.drupal.org/u/mohit_aghera [17] https://www.drupal.org/u/xjm [18] https://www.drupal.org/u/bramdriesen [19] https://www.drupal.org/u/catch [20] https://www.drupal.org/u/greggles [21] https://www.drupal.org/u/larowlan [22] https://www.drupal.org/u/longwave [23] https://www.drupal.org/u/xjm [24] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-153 Project: Ultimate Table Field [1] Date: 2026-September-09 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.1.1 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-87955 Description: The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location. This vulnerability is partially mitigated by the fact that only files with the pdf, doc and docx extensions are accepted. Solution: Install the latest version and adjust permissions: * If you use the 2.x branch of the Ultimate Table Field module , upgrade to Ultimate Table Field 2.0.1 [3]. * If you use the 1.x branch of the Ultimate Table Field module , upgrade to Ultimate Table Field 1.1.1 [4]. After updating, grant the new permission /Use the Ultimate Table Field cell editor/ to every role that edits content containing an Ultimate Table field. Without it, editors can no longer open the cell editor dialog. Releases of the 1.0.x branch are not supported and do not receive security coverage. Upgrade to 1.1.1 or 2.0.1. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Brahim Khouy (b.khouy) [6] Coordinated By: * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team * Swan Kalata (akalata) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/ultimate_table_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ultimate_table_field/releases/2.0.1 [4] https://www.drupal.org/project/ultimate_table_field/releases/1.1.1 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/bkhouy [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://www.drupal.org/u/akalata [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-152 Project: Taxonomy Term Glossary [1] Date: 2026-September-09 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <4.6.0 CVE IDs: CVE-2026-87954 Description: This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise restricted. Solution: Install the latest version: * If you use the Taxonomy Term Glossary module, upgrade to term_glossary 4.6.0 [3]. The 4.4.x and 4.5.x branches are no longer supported. Reported By: * Hemant Gupta (guptahemant) [4] * Marcus Johansson (marcus_johansson) [5] * Serhii Checheniev (serhii-che) [6] Fixed By: * Frank Mably (mably) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team * Swan Kalata (akalata) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/term_glossary [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/term_glossary/releases/4.6.0 [4] https://www.drupal.org/u/guptahemant [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/serhii-che [7] https://www.drupal.org/u/mably [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://www.drupal.org/u/akalata [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0