View online: https://www.drupal.org/sa-contrib-2026-216 Project: Restrict route by IP [1] Project machine name: restrict_route_by_ip Date: 2026-October-07 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.1 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-107255 Description: This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic. Solution: Install the latest version: * If you use the Restrict route by IP 2.0.x, upgrade to Restrict route by IP 2.0.1 [3] * If you use the Restrict route by IP 1.3.x, upgrade to Restrict route by IP 1.3.1 [4] Reported By: * Elia Wehbe (ewehbe) [5] Fixed By: * Elia Wehbe (ewehbe) [6] * solideogloria [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/restrict_route_by_ip [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/restrict_route_by_ip/releases/2.0.1 [4] https://www.drupal.org/project/restrict_route_by_ip/releases/1.3.1 [5] https://www.drupal.org/u/ewehbe [6] https://www.drupal.org/u/ewehbe [7] https://www.drupal.org/u/solideogloria [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....