- Security-news - lists.drupal.org

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
by security-news＠drupal.org 29 Jul '26

29 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-092 Project: Powerful Surveys [1] Date: 2026-July-29 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-18261 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/powerful_surveys [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091
by security-news＠drupal.org 29 Jul '26

29 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-091 Project: Disable Login Page [1] Date: 2026-July-29 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-18260 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/disable_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
by security-news＠drupal.org 29 Jul '26

29 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-090 Project: Token Content Access [1] Date: 2026-July-29 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <3.1.2 CVE IDs: CVE-2026-18259 Description: The Token Content Access module enables site administrators to provide access to content using access tokens. The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access restrictions for content protected by this module. This vulnerability is mitigated by the fact that an attacker must know or discover a URL for content protected by Token Content Access, and exploiting the issue requires measuring timing differences in token comparison responses. Solution: Install the latest version: * If you use the Token Content Access module for Drupal 10.x/11.x, upgrade to Token Content Access 3.1.2 [3] Reported By: * Robin (robincs) [4] Fixed By: * Kyrylo Loboda (lobodakyrylo) [5] Coordinated By: * Bram Driesen (bramdriesen) [6] of the Drupal Security Team * cilefen (cilefen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Swan Kalata (akalata) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/tca [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tca/releases/3.1.2 [4] https://www.drupal.org/u/robincs [5] https://www.drupal.org/u/lobodakyrylo [6] https://www.drupal.org/u/bramdriesen [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/akalata [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-087 Project: Webform REST [1] Date: 2026-July-22 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <4.0.3 CVE IDs: CVE-2026-16644 Description: This module enables you to retrieve and submit webform submissions via REST endpoints. The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions. This vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource. This advisory only affects already-unsupported versions 4.0.3 and earlier. Solution: Install the latest version: * If you use the Webform Rest module for Drupal 8.x, upgrade to Webform Rest 4.1.0 [3] * Version 4.2.0 already has the fix included so no action needed if you use that version Reported By: * Giuseppe (giuseppe87) [4] Fixed By: * Dan Chadwick (danchadwick) [5] * Giuseppe (giuseppe87) [6] * Jacob Rockowitz (jrockowitz) [7] * Liam Morland (liam morland) [8] * Nelson Alves (nsalves) [9] Coordinated By: * Anna Kalata (akalata) [10] of the Drupal Security Team * cilefen (cilefen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Michael Hess (mlhess) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/webform_rest [2] https://www.drupal.org/security-team/risk-levels [3] project/webform_rest/releases/4.1.0 [4] https://www.drupal.org/u/giuseppe87 [5] https://www.drupal.org/u/danchadwick [6] https://www.drupal.org/u/giuseppe87 [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/liam-morland [9] https://www.drupal.org/u/nsalves [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/cilefen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/mlhess [14] https://www.drupal.org/u/poker10 [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Security advisory coverage removed - PSA-2026-07-22
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/psa-2026-07-22 Date: 2026-July-22 Description: QA Accounts [1] enables you to login to a Drupal site using a well known username/password combination. When 1.0 was released, it also was marked for security coverage. The module prioritizes ease of use rather than security and is only intended to be used on sites that are not accessible on the internet (e.g. behind firewall or other protection). The maintainers are choosing to remove security coverage. Solution: Ensure qa_accounts is not enabled on any publicly available site. Reported By: * Jordan Barnes (j-barnes) [2] Fixed By: * Jakob P (japerry) [3] ------------------------------------------------------------------------------ Contribution record [4] [1] https://www.drupal.org/project/qa_accounts [2] https://www.drupal.org/u/j-barnes [3] https://www.drupal.org/u/japerry [4] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-086 Project: Lunr exposed filters [1] Date: 2026-July-22 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-16643 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/lunr_filters [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-085 Project: Email Login OTP [1] Date: 2026-July-22 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-16642 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [6] [1] https://www.drupal.org/project/email_login_otp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://www.drupal.org/u/prudloff [6] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-084 Project: Commerce Elavon [1] Date: 2026-July-22 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-16641 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/commerce_elavon [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-083 Project: PanKM [1] Date: 2026-July-22 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-16640 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/pankm [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
by security-news＠drupal.org 22 Jul '26

22 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-082 Project: Search API Autocomplete [1] Date: 2026-July-22 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site Scripting Affected versions: <1.12.0 CVE IDs: CVE-2026-16640 Description: This module enables you to add autocomplete suggestions for search forms created with the Search API module [3]. The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that the web server must be configured to display warning messages to users. Solution: Install the latest version: * If you use the Serach API Autocomplete module, upgrade to Serach API Autocomplete 8.x-1.12 [4] Another option for sites unable to update is to set display_errors: off in php.ini (or similar settings) to disable the exploit. Reported By: * Elar Lang (elarlang) [5] Fixed By: * Thomas Seiber (drunken monkey) [6] * Elar Lang (elarlang) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Lee Rowlands (larowlan) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/search_api_autocomplete [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/search_api [4] https://www.drupal.org/project/search_api_autocomplete/releases/8.x-1.12 [5] https://www.drupal.org/u/elarlang [6] https://www.drupal.org/u/drunken-monkey [7] https://www.drupal.org/u/elarlang [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/larowlan [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0