Security-news

security-news@drupal.org

1 participants
1782 discussions

OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025
by security-news＠drupal.org 04 Mar '26

04 Mar '26

View online: https://www.drupal.org/sa-contrib-2026-025 Project: OpenID Connect / OAuth client [1] Date: 2026-March-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Server-side request forgery, Information disclosure Affected versions: <1.5.0 CVE IDs: CVE-2026-3530 Description: This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate certain fields coming from the identity provider, which could lead to SSRF and information disclosures. This vulnerability is mitigated by: - an attacker must have access to the identity provider to provide compromised data at the source profile. - a site must have specific field mappings configured Solution: Install the latest version: * If you use the OpenID Connect 8.x-1.x module upgrade to OpenID Connect 8.x-1.5 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Drew Webber (mcdruid) [5] of the Drupal Security Team * Philip Frilling (pfrilling) [6] Coordinated By: * Damien McKenna (damienmckenna) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/openid_connect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/openid_connect/releases/8.x-1.5 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/pfrilling [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024
by security-news＠drupal.org 04 Mar '26

04 Mar '26

View online: https://www.drupal.org/sa-contrib-2026-024 Project: Google Analytics GA4 [1] Date: 2026-March-04 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site Scripting Affected versions: <1.1.13 CVE IDs: CVE-2026-3529 Description: The Google Analytics GA4 module enables users to add custom attributes to the script tag used to load the Google Analytics library. The module does not sufficiently sanitize these attributes. This vulnerability is mitigated by the fact that an attacker must have a role with the "ga4 configure" (or "administer google analytics ga4 settings") permission. An attacker with this permission could inject malicious JavaScript via event handlers (such as onload) or override the script source, leading to a Cross-Site Scripting (XSS) attack on all pages where the GA4 script is loaded. Solution: Install the latest version: * If you use the Google Analytics GA4 module, upgrade to Google Analytics GA4 1.1.13 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Sujan Shrestha (sujan shrestha) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/ga4_google_analytics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ga4_google_analytics/releases/1.1.13 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/sujan-shrestha [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023
by security-news＠drupal.org 04 Mar '26

04 Mar '26

View online: https://www.drupal.org/sa-contrib-2026-023 Project: Calculation Fields [1] Date: 2026-March-04 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site Scripting Affected versions: <1.0.4 CVE IDs: CVE-2026-3528 Description: This module extends the Drupal form API adding "Calculation element" form element types, which can evaluate a maths expression. It offers webform integration. The module doesn't sufficiently validate user input; this could be exploited to achieve Information Disclosure or Cross-site Scripting (XSS). Solution: Install the latest version: * If you use the Calculation fields module, upgrade to Calculation fields 1.0.4 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Joao Paulo Constantino (joaopauloc.dev) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/calculation_fields [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/calculation_fields/releases/1.0.4 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/joaopaulocdev [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022
by security-news＠drupal.org 04 Mar '26

04 Mar '26

View online: https://www.drupal.org/sa-contrib-2026-022 Project: AJAX Dashboard [1] Date: 2026-March-04 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.1.0 CVE IDs: CVE-2026-3527 Description: AJAX Dashboard: Entity Dashboards enables you to create configurable dashboards attached to entities which include AJAX-reloading of a main content area based on inputs from a configurable set of buttons. The module doesn't sufficiently check access on the dashboard configuration route. Unauthorized users could access the entity dashboard configuration page and either enable or disable dashboards. The affected administration page does not permit editing the configurations of the dashboards themselves. The vulnerability is mitigated by the fact that the AJAX Dashboard Entity Dashboard submodule must be enabled. Solution: Install the latest version of the AJAX Dashboard module, which includes the update to AJAX Dashboard: Entity Dashboards: * If you use the AJAX Dashboard module, upgrade to AJAX Dashboard 3.1.0 [3] Reported By: * Juraj Nemec (poker10) [4] of the Drupal Security Team Fixed By: * Michael Nolan (laboratory.mike) [5] Coordinated By: * Bram Driesen (bramdriesen) [6] provisional member of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ajax_dashboard [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3576913 [4] https://www.drupal.org/u/poker10 [5] https://www.drupal.org/u/laboratorymike [6] https://www.drupal.org/u/bramdriesen [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021
by security-news＠drupal.org 04 Mar '26

04 Mar '26

View online: https://www.drupal.org/sa-contrib-2026-021 Project: File Access Fix (deprecated) [1] Date: 2026-March-04 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.2.0 CVE IDs: CVE-2026-3526 Description: This module moves files to and from private storage depending on the access of its owning entities. The module does not always validate the access logic correctly, resulting in files attached to an entity not being protected in certain circumstances. This vulnerability is mitigated by the fact that saving an entity a second time resolves the issue. Solution: Install the latest version: * If you use the File access fix module, upgrade to File access fix 8.x-1.2 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Merlin Axel Rutz (geek-merlin) [5] Coordinated By: * Damien McKenna (damienmckenna) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/file_access_fix [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_access_fix/releases/8.x-1.2 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/geek-merlin [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020
by security-news＠drupal.org 04 Mar '26

04 Mar '26

View online: https://www.drupal.org/sa-contrib-2026-020 Project: File Access Fix (deprecated) [1] Date: 2026-March-04 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.2.0 CVE IDs: CVE-2026-3525 Description: This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook_file_download when a custom or contrib module implements that hook leading to access bypass. Solution: Install the latest version: * If you use the File access fix module, upgrade to File access fix 8.x-1.2 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Merlin Axel Rutz (geek-merlin) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/file_access_fix [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_access_fix/releases/8.x-1.2 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/geek-merlin [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019
by security-news＠drupal.org 25 Feb '26

25 Feb '26

View online: https://www.drupal.org/sa-contrib-2026-019 Project: Responsive Favicons [1] Date: 2026-February-25 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <2.0.2 CVE IDs: CVE-2026-3218 Description: This module adds the favicons generated by realfavicongenerator.net to your Drupal site. The module does not filter administrator-entered text, leading to a persistent Cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer responsive favicons". Solution: Install the latest version, then confirm the permissions associated with the module are assigned to appropriate roles. * If you use the Responsive Favicons module version 2.0.1 or lower, upgrade to Responsive Favicons 2.0.2 [3]. * 4.x and 3.x branches are not affected by this vulnerability. Reported By: * Simon Bäse (simonbaese) [4] Fixed By: * Frank Mably (mably) [5] * Sean Hamlin (wiifm) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/responsive_favicons [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/responsive_favicons/releases/2.0.2 [4] https://www.drupal.org/u/simonbaese [5] https://www.drupal.org/u/mably [6] https://www.drupal.org/u/wiifm [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
by security-news＠drupal.org 25 Feb '26

25 Feb '26

View online: https://www.drupal.org/sa-contrib-2026-018 Project: SAML SSO - Service Provider [1] Date: 2026-February-25 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <3.1.3 CVE IDs: CVE-2026-3217 Description: This module enables you to perform SAML protocol-based single sign-on (SSO) on a Drupal site. The module doesn't sufficiently sanitize user input, leading to a reflected Cross-site scripting (XSS) vulnerability. Solution: Install the latest version: * If you are using the "SAML SSO- Service Provider" module for Drupal, upgrade to SAML SSO- Service Provider 3.1.3 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Sudhanshu Dhage (sudhanshu0542) [5] Coordinated By: * Drew Webber (mcdruid) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/miniorange_saml [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_saml/releases/3.1.3 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/sudhanshu0542 [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
by security-news＠drupal.org 25 Feb '26

25 Feb '26

View online: https://www.drupal.org/sa-contrib-2026-017 Project: Drupal Canvas [1] Date: 2026-February-25 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Server-side request forgery, Information disclosure Affected versions: <1.1.1 CVE IDs: CVE-2026-3216 Description: This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers. The project has a hidden sub-module, *Drupal Canvas AI*, which is disabled by default. It is typically enabled as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). When the submodule is enabled, the following vulnerability is exposed. The module doesn't sufficiently sanitize user-supplied data via crafted API requests within the messages JSON payload. It is mitigated by the fact that an attacker must have a role with the permission "use Drupal Canvas AI". *How the Canvas AI sub-module gets enabled:* As a hidden submodule, canvas_ai is not intended for manual activation via the UI. It is designed to be pulled in as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). Solution: Install the latest version: * If you use the Drupal Canvas module, upgrade to Drupal Canvas 1.1.1 [3]. Sites witthout the hidden submodule enabled are not vulnerable. The module is hidden from the UI module list, but admins can verify its status via the command line: drush config:get core.extension | grep canvas_ai Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Bálint Kléri (balintbrews) [5] * Ignacio Sánchez Holgueras (isholgueras) [6] * Drew Webber (mcdruid) [7] of the Drupal Security Team * Narendra Singh Rathore (narendrar) [8] * Christian López Espínola (penyaskito) [9] * Tim Plunkett (tim.plunkett) [10] Coordinated By: * Greg Knaddison (greggles) [11] of the Drupal Security Team * Drew Webber (mcdruid) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team * Jess (xjm) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/canvas [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/canvas/releases/1.1.1 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/balintbrews [6] https://www.drupal.org/u/isholgueras [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/narendrar [9] https://www.drupal.org/u/penyaskito [10] https://www.drupal.org/u/timplunkett [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/mcdruid [13] https://www.drupal.org/u/poker10 [14] https://www.drupal.org/u/xjm [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016
by security-news＠drupal.org 25 Feb '26

25 Feb '26

View online: https://www.drupal.org/sa-contrib-2026-016 Project: Islandora [1] Date: 2026-February-25 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Arbitrary file upload, Cross-site scripting Affected versions: <2.17.5 CVE IDs: CVE-2026-3215 Description: This module integrates with Islandora, an open-source digital asset management (DAM) framework. Islandora integrates with various open-source services, which can be run in a distributed environment. The module doesn't sufficiently sanitize URI paths for its custom route used for attaching media to nodes, which can also lead to cross-site scripting and other vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create media" and the ability to edit the node the media is being attached to. Solution: Install the latest version: * If you use the Islandora module, upgrade to Islandora 2.17.5 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Joe Corall (joecorall) [5] * Rosie Le Faive (rosiel) [6] Coordinated By: * Damien McKenna (damienmckenna) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/islandora [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/islandora/releases/2.17.5 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/joecorall [6] https://www.drupal.org/u/rosiel [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news