- Security-news - lists.drupal.org

Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
by security-news＠drupal.org 19 Aug '26

19 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-102 Project: Screenshot [1] Date: 2026-August-19 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-76759 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Conrad Lara (cmlara) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Heine Deelstra (heine) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/screenshot [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/heine [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101
by security-news＠drupal.org 19 Aug '26

19 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-101 Project: Link content parser [1] Date: 2026-August-19 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-76758 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Coordinated By: * Heine Deelstra (heine) [5] of the Drupal Security Team * Drew Webber (mcdruid) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/postlight_parser [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/heine [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
by security-news＠drupal.org 19 Aug '26

19 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-100 Project: Gammu SMS Daemon [1] Date: 2026-August-19 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-76755CVE-2026-76756CVE-2026-76757 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Coordinated By: * Greg Knaddison (greggles) [5] of the Drupal Security Team * Heine Deelstra (heine) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/gammu_smsd [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/greggles [6] https://www.drupal.org/u/heine [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-099 Project: Quick Tabs [1] Date: 2026-August-12 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.3.1 CVE IDs: CVE-2026-73477 Description: This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and performed no access check for reusable custom blocks. Content that should have been denied was therefore rendered — for example, an unpublished node or unpublished reusable custom block could be shown to users without permission to view it. The access bypass is mitigated by the fact that affected content is selected by a user with the “administer quicktabs” permission when the tab is configured, so an attacker cannot choose which content is exposed. Solution: Install the latest version: * If you use the Quick Tabs module for Drupal, upgrade to Quick Tabs 4.3.1 [3] Reported By: * Joël Pittet (joelpittet) [4] Fixed By: * Joël Pittet (joelpittet) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/quicktabs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/quicktabs/releases/4.3.1 [4] https://www.drupal.org/u/joelpittet [5] https://www.drupal.org/u/joelpittet [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-098 Project: External Authentication [1] Date: 2026-August-12 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.0.13 CVE IDs: CVE-2026-73476 Description: This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This vulnerability is mitigated by the fact that it affects only sites using impacted MySQL or MariaDB collation settings for the module’s authentication mapping storage. Solution: Install the latest version: * If you use the externalauth module for Drupal, upgrade to 2.0.13 [3] Reported By: * 晉宇林 (whale120) [4] Fixed By: * Sven Decabooter (svendecabooter) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/externalauth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/externalauth/releases/2.0.13 [4] https://www.drupal.org/u/whale120 [5] https://www.drupal.org/u/svendecabooter [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Entity Share Websub - Critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-097 Project: Entity Share Websub [1] Date: 2026-August-12 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:None/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: Server-side request forgery (SSRF) Affected versions: <1.1.2 CVE IDs: CVE-2026-73474 Description: This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks. Solution: Install the latest version: * If you use the Entity Share Websub module for Drupal 9.x or 10.x, upgrade to Entity Share Websub 1.1.2 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Shawn Duncan (fathershawn) [5] * Jeffrey S. Mattson (jeffreysmattson) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/entity_share_websub [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_share_websub/releases/1.1.2 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/fathershawn [6] https://www.drupal.org/u/jeffreysmattson [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-096 Project: Diff [1] Date: 2026-August-12 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.1 || >=2.1.0 <2.1.1 CVE IDs: CVE-2026-73478 Description: This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission view the entity. Solution: Install the latest version: * If you use the Diff module, upgrade to Diff 2.1.1 [3] or Diff 2.0.1 [4] Reported By: * Alexei Rayu (alexrayu) [5] Fixed By: * Adam Bramley (acbramley) [6] * Derek Wright (dww) [7] * Lee Rowlands (larowlan) [8] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Lee Rowlands (larowlan) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/diff [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/diff/releases/2.1.1 [4] https://www.drupal.org/project/diff/releases/2.0.1 [5] https://www.drupal.org/u/alexrayu [6] https://www.drupal.org/u/acbramley [7] https://www.drupal.org/u/dww [8] https://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/larowlan [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
by security-news＠drupal.org 12 Aug '26

12 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-095 Project: Commerce PayPal [1] Date: 2026-August-12 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.12.0 || >=2.1.0 <2.1.3 || 2.0.* CVE IDs: CVE-2026-73475 Description: This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link payment gateway. Solution: * If you use the Commerce Paypal module for Drupal, upgrade to Commerce Paypal 2.1.3 [3] or Commerce Paypal 8.x-1.12 [4] Reported By: * Kimberley Massey (kimberleycgm) [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] * Kimberley Massey (kimberleycgm) [7] * Ryan Szrama (rszrama) [8] * Tom Ashe (tomtech) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Benji Fisher (benjifisher) [11] of the Drupal Security Team * Neil Drumm (drumm) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/commerce_paypal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_paypal/releases/2.1.3 [4] https://www.drupal.org/project/commerce_paypal/releases/8.x-1.12 [5] https://www.drupal.org/u/kimberleycgm [6] https://www.drupal.org/u/jsacksick [7] https://www.drupal.org/u/kimberleycgm [8] https://www.drupal.org/u/rszrama [9] https://www.drupal.org/u/tomtech [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/benjifisher [12] https://www.drupal.org/u/drumm [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/poker10 [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
by security-news＠drupal.org 05 Aug '26

05 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-094 Project: Entity Browser [1] Date: 2026-August-05 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Affected versions: <2.16.0 CVE IDs: CVE-2026-18986 Description: The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser. Solution: Install the latest version: * If you use the Entity Browser module, upgrade to Entity Browser 8.x-2.16 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Julian Pustkuchen (anybody) [5] * Sascha Grossenbacher (berdir) [6] * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/entity_browser [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_browser/releases/8.x-2.16 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/berdir [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
by security-news＠drupal.org 05 Aug '26

05 Aug '26

View online: https://www.drupal.org/sa-contrib-2026-093 Project: Edit in-place field [1] Date: 2026-August-05 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.1 CVE IDs: CVE-2026-18985 Description: This module provides formatters to allow in-place editing in a View or other display (full content, teaser...). The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission". Solution: Install the latest version: * If you use the Edit in-place field module for Drupal, upgrade to 2.1.1 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Bálint Nagy (nagy.balint) [5] Coordinated By: * Neil Drumm (drumm) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/edit_in_place_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/edit_in_place_field/releases/2.1.1 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/nagybalint [6] https://www.drupal.org/u/drumm [7] https://www.drupal.org/u/greggles [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0