- Security-news - lists.drupal.org

Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-069 Project: Colorbox [1] Date: 2026-July-01 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: < 2.1.5 || 2.2.0 CVE IDs: CVE-2026-58591 Description: The Colorbox module integrates with the Colorbox JavaScript library to display content in an overlay above the page. The module doesn't sufficiently protect against injection of malicious JavaScript under certain scenarios. This vulnerability is mitigated by the fact that an attacker must have a role that permits them to enter HTML content. Solution: Install the latest version: * If you use Colorbox 2.1.x, upgrade to: Colorbox 2.1.5 [3] * If you use Colorbox 2.2.x, upgrade to: Colorbox 2.2.1 [4] Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Paul McKibben (paulmckibben) [6] Coordinated By: * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185155-colorbox-security/-/work_items/1 [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/colorbox [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/colorbox/releases/2.1.5 [4] https://www.drupal.org/project/colorbox/releases/2.2.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/paulmckibben [7] https://www.drupal.org/u/prudloff [8] https://git.drupalcode.org/security/185155-colorbox-security/-/work_items/1 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-068 Project: FlowDrop [1] Date: 2026-July-01 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-58590 Description: This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the user. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer FlowDrop workflows" (or the equivalent "Create FlowDrop workflows" / "Edit FlowDrop workflows" permissions). Solution: Install the latest version: * If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0 [3] Reported By: * Aincient Labs (aincient labs) [4] Fixed By: * Shibin Das (d34dman) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Dave Long (longwave) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3592075-flowdrop-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/flowdrop [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/flowdrop/releases/1.6.0 [4] https://www.drupal.org/u/aincient-labs [5] https://www.drupal.org/u/d34dman [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/longwave [10] https://git.drupalcode.org/security/3592075-flowdrop-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-067 Project: FlowDrop [1] Date: 2026-July-01 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-58589 Description: This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution (incurring LLM spend and tool side effects) or send messages into other user's sessions. This vulnerability is mitigated by the fact that an attacker must have the permission "View any session", which is not granted to anonymous or authenticated users by default. Solution: Install the latest version: * If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0 [3] Driving a session now additionally requires the "Execute session workflow" permission. Reported By: * Aincient Labs (aincient labs) [4] Fixed By: * Shibin Das (d34dman) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Dave Long (longwave) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3592076-flowdrop-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/flowdrop [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/flowdrop/releases/1.6.0 [4] https://www.drupal.org/u/aincient-labs [5] https://www.drupal.org/u/d34dman [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/longwave [10] https://git.drupalcode.org/security/3592076-flowdrop-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-066 Project: Drupal Canvas [1] Date: 2026-July-01 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper validation Affected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1 CVE IDs: CVE-2026-58588 Description: The Canvas module allow you to upload image files via a custom API. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior. Solution: Install the latest version: * If you use the 1.4.1 version of Canvas, upgrade to 1.4.2 [3] * If you use the 1.5.1 version of Canvas, upgrade to 1.5.2 [4] * If you use the 1.6.0 version of Canvas, upgrade to 1.6.1 [5] * If you use the 1.7.0 version of Canvas, upgrade to 1.7.1 [6] Reported By: * Christian López Espínola (penyaskito) [7] Fixed By: * AKHIL BABU (akhil babu) [8] * Christian López Espínola (penyaskito) [9] Coordinated By: * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/canvas [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/canvas/releases/1.4.2 [4] https://www.drupal.org/project/canvas/releases/1.5.2 [5] https://www.drupal.org/project/canvas/releases/1.6.1 [6] https://www.drupal.org/project/canvas/releases/1.7.1 [7] https://www.drupal.org/u/penyaskito [8] https://www.drupal.org/u/akhil-babu [9] https://www.drupal.org/u/penyaskito [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065
by security-news＠drupal.org 01 Jul '26

01 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-065 Project: Drupal Canvas [1] Date: 2026-July-01 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper validation Affected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1 CVE IDs: CVE-2026-58587 Description: The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat. These file uploads are insufficiently validated before being written to Drupal's temporary directory. In some cases, this may lead to cross-site scripting (XSS). Solution: Install the latest version: * If you use the 1.4.1 version of Canvas, upgrade to 1.4.2 [3] * If you use the 1.5.1 version of Canvas, upgrade to 1.5.2 [4] * If you use the 1.6.0 version of Canvas, upgrade to 1.6.1 [5] * If you use the 1.7.0 version of Canvas, upgrade to 1.7.1 [6] Reported By: * AKHIL BABU (akhil babu) [7] Fixed By: * Alex Bronstein (effulgentsia) [8] of the Drupal Security Team * Christian López Espínola (penyaskito) [9] Coordinated By: * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3591755-canvas-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/canvas [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/canvas/releases/1.4.2 [4] https://www.drupal.org/project/canvas/releases/1.5.2 [5] https://www.drupal.org/project/canvas/releases/1.6.1 [6] https://www.drupal.org/project/canvas/releases/1.7.1 [7] https://www.drupal.org/u/akhil-babu [8] https://www.drupal.org/u/effulgentsia [9] https://www.drupal.org/u/penyaskito [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/3591755-canvas-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Tealium iQ Tag Management - Critical - Unsupported - SA-CONTRIB-2026-064
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-064 Project: Tealium iQ Tag Management [1] Date: 2026-June-24 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-13244 Description: The security team is marking the Tealium iQ Tag Management module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Coordinated By: * Benji Fisher (benjifisher) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185189-tealiumiq-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/tealiumiq [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/benjifisher [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://git.drupalcode.org/security/185189-tealiumiq-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-063 Project: Salesforce Suite [1] Date: 2026-June-24 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site request forgery Affected versions: <5.1.3 CVE IDs: CVE-2026-13243 Description: The Salesforce Suite of modules integrates Drupal with Salesforce. The Salesforce module does not properly validate the OAuth handshake during interactive authentication, allowing an attacker to hijack the authorization token and bind the site to an attacker's Salesforce account. This vulnerability is mitigated by the fact that salesforce_oauth submodule must be enabled, and a salesforce_oauth authorization profile active and in use. The submodule salesforce_oauth is deprecated, and salesforce_jwt has been the recommended authentication plugin for several years. Sites with salesforce_oauth uninstalled, or sites relying exclusively on salesforce_jwt (JWT or JWT Gov Cloud) for authentication are not impacted. Submodule salesforce_oauth has been removed in branch 6.0.x, so >= 6.0.x versions are not affected by this vulnerability. Solution: *Recommended solution:* * Update to Salesforce Suite version 5.1.3 [3] * Uninstall salesforce_oauth module *Alternative solution*, if you must continue to use salesforce_oauth module: * Update to Salesforce Suite version 5.1.3 [4] * Revoke existing oauth provider tokens * Re-authenticate all existing oauth providers Reported By: * Muhammedali Aliyev (swordmein) [5] Fixed By: * Aaron Bauman (aaronbauman) [6] Coordinated By: * Neil Drumm (drumm) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Pierre Rudloff (prudloff) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185127-salesforce-security/-/work_items… [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/salesforce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/salesforce/releases/5.1.3 [4] https://www.drupal.org/project/salesforce/releases/5.1.3 [5] https://www.drupal.org/u/swordmein [6] https://www.drupal.org/u/aaronbauman [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/prudloff [10] https://git.drupalcode.org/security/185127-salesforce-security/-/work_items… [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-062 Project: Geolocation Field [1] Date: 2026-June-24 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: SQL Injection Affected versions: <3.15.0 CVE IDs: CVE-2026-13242 Description: Geolocation modules adds a field to store coordinates and provides supporting plumbing for views and other modules. One of the provided views filters does not sufficiently sanitize values if exposed to user input resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a view must exist, that uses the aforementioned filter and it is set to accept user input. Solution: Install the latest version: * If you use the Geolocation Field module for Drupal, upgrade to Geolocation Field 8.x-3.15 [3] Reported By: * Michael Maturi (michaelmaturi) [4] Fixed By: * Michael Maturi (michaelmaturi) [5] * Christian Adamski (christianadamski) [6] Coordinated By: * cilefen (cilefen) [7] of the Drupal Security Team * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185170-geolocation-security/-/work_item… [12] ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/geolocation [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/geolocation/releases/8.x-3.15 [4] https://www.drupal.org/u/michaelmaturi [5] https://www.drupal.org/u/michaelmaturi [6] https://www.drupal.org/u/christianadamski [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://git.drupalcode.org/security/185170-geolocation-security/-/work_item… [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-061 Project: Paragraphs [1] Date: 2026-June-24 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.21.0 CVE IDs: CVE-2026-13241 Description: The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficiently restrict access to direct child paragraphs of library items through API endpoints. This vulnerability is mitigated by the fact the paragraphs_library module must be in use and general write access to paragraphs through another module must be allowed. Solution: Install the latest version: * If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21 [3] Reported By: * Mustafa Ahmed (mustafa007) [4] Fixed By: * Sascha Grossenbacher (berdir) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185093-paragraphs-security/-/work_items… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/paragraphs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/paragraphs/releases/8.x-1.21 [4] https://www.drupal.org/u/mustafa007 [5] https://www.drupal.org/u/berdir [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://git.drupalcode.org/security/185093-paragraphs-security/-/work_items… [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-060 Project: Paragraphs [1] Date: 2026-June-24 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.21.0 CVE IDs: CVE-2026-13240 Description: The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficiently restrict access to unpublished library items in lists. This vulnerability is mitigated by the fact the paragraphs_library module must be in use, and that an attacker must have access to a list of library items, such as a field with autocomplete suggestions or a view. Solution: Install the latest version: * If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Sascha Grossenbacher (berdir) [5] * Pierre Rudloff (prudloff) [6] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185207-paragraphs-security/-/work_items… [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/paragraphs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/paragraphs/releases/8.x-1.21 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/berdir [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/prudloff [9] https://git.drupalcode.org/security/185207-paragraphs-security/-/work_items… [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0