September 2026 - Security-news

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-132 Project: Unpublished Node Permissions [1] Date: 2026-September-02 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.8.0 CVE IDs: CVE-2026-84920 Description: This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place. Solution: Install the latest version: * If you use the Unpublished Node Permissions module, upgrade to Unpublished Node Permissions 8.x-1.8. [3] Reported By: * Erwin Eggenberger (eeg) [4] * Jon Jordan (joncjordan) [5] Fixed By: * Fabien Gutknecht (fabsgugu) [6] * Jon Jordan (joncjordan) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Damien McKenna (damienmckenna) [9] of the Drupal Security Team * Neil Drumm (drumm) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Pierre Rudloff (prudloff) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/unpublished_node_permissions [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/unpublished_node_permissions/releases/8.x-1.8 [4] https://www.drupal.org/u/eeg [5] https://www.drupal.org/u/joncjordan [6] https://www.drupal.org/u/fabsgugu [7] https://www.drupal.org/u/joncjordan [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/damienmckenna [10] https://www.drupal.org/u/drumm [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/prudloff [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-131 Project: PhotoSwipe - Responsive JavaScript Modal Image Gallery [1] Date: 2026-September-02 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <5.0.9 CVE IDs: CVE-2026-84919 Description: This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input (such as image alt tags) in its dynamic caption script, leading to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role that permits them to enter HTML content. Solution: Install the latest version: * If you use the photoswipe_dynamic_caption module, upgrade to photoswipe 5.0.9 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Bram Driesen (bramdriesen) [5] of the Drupal Security Team * Joshua Sedler (grevil) [6] * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Pierre Rudloff (prudloff) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/photoswipe [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/photoswipe/releases/5.0.9 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/bramdriesen [6] https://www.drupal.org/u/grevil [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/prudloff [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-130 Project: Monobank payment API [1] Date: 2026-September-02 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.3 CVE IDs: CVE-2026-84918 Description: The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks. Solution: Install the latest version: * If you use the Monobank payment API module, upgrade to the monobank 1.0.3 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Helena Zajika (helena zajika) [5] * Marcus Johansson (marcus_johansson) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/monobank [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/monobank/releases/1.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/helena-zajika [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-128 Project: Mailer Plus Log [1] Date: 2026-September-02 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.2.7 CVE IDs: CVE-2026-16648 Description: This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can view the log can obtain a one-time login link for any account, including user 1, and use it to log in as that account. This vulnerability is mitigated by the fact that an attacker must have a role with the permission View Drupal Symfony Mailer log entries, which in earlier releases was not marked as a restricted permission. Solution: Install the latest version: * If you use the Mailer Plus Log module (previously known as Symfony Mailer Log), upgrade to Mailer Plus Log 1.2.7 [3] * After updating, run database updates so that the email bodies already stored in the log are redacted. * Review who should have the View Drupal Symfony Mailer log entries permission, and whether your site sends out custom sensitive emails that would need to opt in to the redaction logic. Reported By: * Sven Decabooter (svendecabooter) [4] Fixed By: * Mohit Aghera (mohit_aghera) [5] provisional member of the Drupal Security Team * Sven Decabooter (svendecabooter) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/symfony_mailer_log [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/symfony_mailer_log/releases/1.2.7 [4] https://www.drupal.org/u/svendecabooter [5] https://www.drupal.org/u/mohit_aghera [6] https://www.drupal.org/u/svendecabooter [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mohit_aghera [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-127 Project: Jsonapi Role Access [1] Date: 2026-September-02 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.2 CVE IDs: CVE-2026-84917 Description: This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest. Solution: Install the latest version: * If you use the Jsonapi Role Access module, upgrade to Jsonapi Role Access 2.0.2 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Julian Pustkuchen (anybody) [5] * Joshua Sedler (grevil) [6] Coordinated By: * Damien McKenna (damienmckenna) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/jsonapi_role_access [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi_role_access/releases/2.0.2 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/grevil [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-126 Project: Islandora [1] Date: 2026-September-02 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.19.0 CVE IDs: CVE-2026-84916 Description: This islandora_advanced_search sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content. This vulnerability is mitigated by the fact that an attacker must know or guess a restricted block’s machine ID, and the block must contain sensitive content protected by block access or visibility restrictions. Additionally, the submodule is not known to be used by any modern Islandora configurations. Solution: Install the latest version: * If you use the Islandora module, upgrade to the latest version Islandora 2.19.0 [3]. Be sure to read the release node for advice on updating Reported By: * Joe Corall (joecorall) [4] Fixed By: * Annie Oelschlager (annieoelschlager) [5] * Joe Corall (joecorall) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/islandora [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3620267 [4] https://www.drupal.org/u/joecorall [5] https://www.drupal.org/u/annieoelschlager [6] https://www.drupal.org/u/joecorall [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-125 Project: Email Verification / SMS Verification / OTP Verification [1] Date: 2026-September-02 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <2.4.0 CVE IDs: CVE-2026-84924 Description: This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting (XSS) vulnerability. Solution: Install the latest version: If you are using the OTP Verification module for Drupal, upgrade to the latest version 8.x-2.4 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Mohammed Hisam (hisam45) [5] * Drew Webber (mcdruid) [6] of the Drupal Security Team * Sudhanshu Dhage (sudhanshu0542) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/otp_verification [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/otp_verification/releases/8.x-2.4 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/hisam45 [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/sudhanshu0542 [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-124 Project: Email Verification / SMS Verification / OTP Verification [1] Date: 2026-September-02 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Affected versions: <2.4.0 CVE IDs: CVE-2026-84923 Description: This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability. Solution: Install the latest version: If you are using the OTP Verification module for Drupal, upgrade to latest version 8.x-2.4 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Mohammed Hisam (hisam45) [5] * Drew Webber (mcdruid) [6] of the Drupal Security Team * Sudhanshu Dhage (sudhanshu0542) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/otp_verification [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/otp_verification/releases/8.x-2.4 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/hisam45 [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/sudhanshu0542 [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-123 Project: Component blocks [1] Date: 2026-September-02 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <1.2.7 CVE IDs: CVE-2026-84915 Description: This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts. Solution: Install the latest version: * If you use the component_blocks module, upgrade to Component Blocks 1.2.7 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Lee Rowlands (larowlan) [5] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Lee Rowlands (larowlan) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/component_blocks [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/component_blocks/releases/1.2.7 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/larowlan [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/larowlan [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-122 Project: Calculate Working Days [1] Date: 2026-September-02 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-84914 Description: Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form. Solution: Install the latest version: * If you use the Calculate Working Days module, upgrade to calculate_working_days 2.0.3 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Vivek kumar (vivek_lnwebworks) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/calculate_working_days [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/calculate_working_days/releases/2.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/vivek_lnwebworks [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0