View online: https://www.drupal.org/psa-2025-11-03
Date: 2025-November-03
Description:
The upcoming Drupal core security release window [1] has been rescheduled
from November 19, 2025 to November 12, 2025. As normal, the window will occur
between 1600 UTC and 2200 UTC.
.... Schedule change for back-to-back DrupalCons
This schedule change is due to DrupalCons Vienna [2] and Nara [3] overlapping
the October and November core security windows. We do not schedule core
security windows during DrupalCons so that site owners and agencies can
attend these conferences without having to worry about their sites or
clients.
December is also not typically used for core security releases due to the
quick sequencing of the Drupal core minor releases and the end-of-year
holidays. This would mean a period of four months where we could not provide
any regularly scheduled security update.
.... No special release procedures
The schedule change is not due to any highly critical issue that would
require special release procedures.
As a reminder, a Drupal core security window does not necessarily mean a
Drupal security release will occur, only that one is possible.
Coordinated By:
* catch (catch) [4] of the Drupal Security Team
* Damien McKenna (damienmckenna) [5] of the Drupal Security Team
* Neil Drumm (drumm) [6] of the Drupal Security Team
* Greg Knaddison (greggles) [7] of the Drupal Security Team
* Lee Rowlands (larowlan) [8] of the Drupal Security Team
* Drew Webber (mcdruid) [9] of the Drupal Security Team
* Juraj Nemec (poker10) [10] of the Drupal Security Team
* Jess (xjm) [11] of the Drupal Security Team
* Cathy Theys (yesct) [12] of the Drupal Security Team
------------------------------------------------------------------------------
Contribution record [13]
[1]
https://www.drupal.org/drupal-security-team/security-release-numbers-and-re…
[2] https://events.drupal.org/vienna2025
[3] https://events.drupal.org/nara2025
[4] https://www.drupal.org/u/catch
[5] https://www.drupal.org/u/damienmckenna
[6] https://www.drupal.org/u/drumm
[7] https://www.drupal.org/u/greggles
[8] https://www.drupal.org/u/larowlan
[9] https://www.drupal.org/u/mcdruid
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/xjm
[12] https://www.drupal.org/u/yesct
[13]
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…
View online: https://www.drupal.org/sa-contrib-2025-114
Project: Simple OAuth (OAuth2) & OpenID Connect [1]
Date: 2025-October-29
Security risk: *Critical* 15 ∕ 25
AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass
Affected versions: <6.0.7
CVE IDs: CVE-2025-12466
Description:
This module introduces an OAuth 2.0 authorization server, which can be
configured to protect your Drupal instance with access tokens, or allow
clients to request new access tokens and refresh them.
The module doesn't sufficiently respect granted scopes, it affects all access
checks that are based on roles. For example: routes that have the _role
requirement, can be bypassed with an access token.
This vulnerability is mitigated by the fact that an attacker must have the
access token in possession and the user related to the token must have the
associated (role requirement) roles assigned.
Solution:
Install the latest version:
* If you use the "Simple OAuth (OAuth2) & OpenID Connect" module for Drupal,
upgrade to Simple OAuth (OAuth2) & OpenID Connect 6.0.7 [3]
Reported By:
* coffeemakr [4]
Fixed By:
* Bojan Bogdanovic (bojan_dev) [5]
* coffeemakr [6]
* Juraj Nemec (poker10) [7] of the Drupal Security Team
Coordinated By:
* Greg Knaddison (greggles) [8] of the Drupal Security Team
* Juraj Nemec (poker10) [9] of the Drupal Security Team
------------------------------------------------------------------------------
Contribution record [10]
[1] https://www.drupal.org/project/simple_oauth
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/simple_oauth/releases/6.0.7
[4] https://www.drupal.org/u/coffeemakr
[5] https://www.drupal.org/u/bojan_dev
[6] https://www.drupal.org/u/coffeemakr
[7] https://www.drupal.org/u/poker10
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10
[10]
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…
View online: https://www.drupal.org/sa-contrib-2025-112
Project: CivicTheme Design System [1]
Date: 2025-October-22
Security risk: *Moderately critical* 12 ∕ 25
AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Information disclosure
Affected versions: <1.12.0
CVE IDs: CVE-2025-12082
Description:
CivicTheme is a design system and theme framework used to build content-rich
Drupal websites. It includes editorial workflows, structured content types,
and flexible theming components.
The theme doesn't sufficiently check access to entities when they are
displayed as reference cards used in manual lists, which leads to an
information disclosure vulnerability
Specifically, when unpublished or archived nodes (CivicTheme Page and Event)
are referenced via card components and placed into manually curated lists or
blocks, a referenced card is rendered on the page for users who do not have
permission to view unpublished content. The referenced node itself is
correctly checked for permission, but the information in the card component
(title, thumbnail, tags) discloses information that the user does not have
access to view.
This results in:
* Draft or never-published Event node data being visible to anonymous users
on cards.
* Archived content persisting in curated content lists.
This disclosure bypasses editorial expectations and may expose sensitive or
internal-only content unintentionally. It does not require complex
interaction or elevated permissions. It is triggered by standard reference
configurations and view templates.
Solution:
Install the latest version:
* If you use the CivicTheme theme for Drupal 10.x / 11.x, upgrade to
CivicTheme-1.12.0 [3]
Reported By:
* Lee Rowlands (larowlan) [4] of the Drupal Security Team
Fixed By:
* Alan Cole (alan.cole) [5]
* Daniel (danielgry) [6]
* Fiona Morrison (fionamorrison23) [7]
* Suchi Garg (gargsuchi) [8]
* Joshua Fernandes (joshua1234511) [9]
* Lee Rowlands (larowlan) [10] of the Drupal Security Team
* Richard Gaunt (richardgaunt) [11]
Coordinated By:
* Greg Knaddison (greggles) [12] of the Drupal Security Team
* Lee Rowlands (larowlan) [13] of the Drupal Security Team
* Drew Webber (mcdruid) [14] of the Drupal Security Team
------------------------------------------------------------------------------
Contribution record [15]
[1] https://www.drupal.org/project/civictheme
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/civictheme/releases/1.12.0
[4] https://www.drupal.org/u/larowlan
[5] https://www.drupal.org/u/alancole
[6] https://www.drupal.org/u/danielgry-0
[7] https://www.drupal.org/u/fionamorrison23
[8] https://www.drupal.org/u/gargsuchi
[9] https://www.drupal.org/u/joshua1234511
[10] https://www.drupal.org/u/larowlan
[11] https://www.drupal.org/u/richardgaunt
[12] https://www.drupal.org/u/greggles
[13] https://www.drupal.org/u/larowlan
[14] https://www.drupal.org/u/mcdruid
[15]
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…
View online: https://www.drupal.org/sa-contrib-2025-111
Project: Reverse Proxy Header [1]
Date: 2025-September-24
Security risk: *Less critical* 8 ∕ 25
AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass
Affected versions: <1.1.2
CVE IDs: CVE-2025-10929
Description:
This module allows you to specify an HTTP header name to determine the
client's IP address.
The module doesn't sufficiently handle all cases under the scenario if Drupal
Core settings $settings['reverse_proxy'] is set to TRUE and
$settings['reverse_proxy_addresses'] is configured.
This vulnerability allows an attacker to spoof a request IP address (as
Drupal sees it), potentially bypassing a variety of controls.
Solution:
To resolve this issue, sites must both upgrade and confirm their settings.
Install the latest 1.1.2 version. [3]
Check your settings:
- $settings['reverse_proxy'] (Drupal Core setting);
- $settings['reverse_proxy_addresses'] (Drupal Core setting);
- $settings['reverse_proxy_header'] (this module setting);
- $settings['reverse_proxy_header_trusted_addresses_ignore'] (this module
setting introduced in this release).
This security release does not affect your Drupal instance if:
- or $settings['reverse_proxy'] is not set or set to FALSE;
- or $settings['reverse_proxy_header'] is not set or set to FALSE;
- or $settings['reverse_proxy_addresses'] is not set or set to an empty
array.
This security release may affect your Drupal instance if:
- and $settings['reverse_proxy'] is set to TRUE;
- and $settings['reverse_proxy_header'] is set;
- and $settings['reverse_proxy_addresses'] is configured.
If your configuration meets all three criteria simultaneously, you need to
verify how Drupal determines the client IP address.
*How to verify:*
It can be checked by sending a request from a non-trusted proxy/server like:
curl -I -H "X-REVERSE-PROXY-HEADER-NAME:8.8.8.8" your-hostname/some-path`
If Drupal detects the client IP address (for example, at the dblog report),
everything works as expected.
If Drupal detects the client IP address as 8.8.8.8, you may need to check
your $settings['reverse_proxy_addresses'] and/or review the documentation in
the README file about
$settings['reverse_proxy_header_trusted_addresses_ignore'].
*Reccomendation:*
Although it is not required to have $settings['reverse_proxy_addresses']
(Drupal Core setting) configured, it's always preferred to do so to improve
security.
Reported By:
* Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security
Team
Fixed By:
* Bohdan Artemchuk (bohart) [5]
* Drew Webber (mcdruid) [6] of the Drupal Security Team
* Pierre Rudloff (prudloff) [7] provisional member of the Drupal Security
Team
Coordinated By:
* Greg Knaddison (greggles) [8] of the Drupal Security Team
* Juraj Nemec (poker10) [9] of the Drupal Security Team
* Pierre Rudloff (prudloff) [10] provisional member of the Drupal Security
Team
------------------------------------------------------------------------------
Contribution record [11]
[1] https://www.drupal.org/project/reverse_proxy_header
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/reverse_proxy_header/releases/1.1.2
[4] https://www.drupal.org/u/prudloff
[5] https://www.drupal.org/u/bohart
[6] https://www.drupal.org/u/mcdruid
[7] https://www.drupal.org/u/prudloff
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10
[10] https://www.drupal.org/u/prudloff
[11]
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…
View online: https://www.drupal.org/sa-contrib-2025-109
Project: Umami Analytics [1]
Date: 2025-September-24
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting
Affected versions: <1.0.1
CVE IDs: CVE-2025-10931
Description:
This module enables you to add Umami Analytics web statistics tracking system
to your website.
The "administer umami analytics" permission allows inserting an arbitrary
JavaScript file on every page. While this is an expected feature, the
permission lacks the "restrict access" flag, which should alert
administrators that this permission is potentially dangerous and can lead to
cross-site scripting (XSS) vulnerabilities.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission “administer umami analytics”.
Solution:
Install the latest version:
* If you use the Umami Analytics module upgrade to Umami Analytics 1.0.1 [3]
or 2.0.-beta3 [4]
Sites are encouraged to review which roles have that permission and which
users have that role, to ensure that only trusted users have that permission.
Reported By:
* Pierre Rudloff (prudloff) [5]
Fixed By:
* Ivica Puljic (pivica) [6]
Coordinated By:
* Damien McKenna (damienmckenna) [7] of the Drupal Security Team
* Juraj Nemec (poker10) [8] of the Drupal Security Team
* Pierre Rudloff (prudloff) [9] provisional member of Drupal Security Team
------------------------------------------------------------------------------
Contribution record [10]
[1] https://www.drupal.org/project/umami_analytics
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/umami_analytics/releases/1.0.1
[4] https://www.drupal.org/project/umami_analytics/releases/2.0.0-beta3
[5] https://www.drupal.org/u/prudloff
[6] https://www.drupal.org/u/pivica
[7] https://www.drupal.org/u/damienmckenna
[8] https://www.drupal.org/u/poker10
[9] https://www.drupal.org/u/prudloff
[10]
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…