View online: https://www.drupal.org/sa-contrib-2026-202 Project: Gutenberg [1] Project machine name: gutenberg Date: 2026-October-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.15.0 || >=3.0.0 <3.0.7 || >=4.0.0 <4.0.0-beta3 CVE IDs: CVE-2026-107263 Description: This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission. Solution: Install the latest version: * If you use the Gutenberg module versions 3.0.x, upgrade to Gutenberg 3.0.7 [3] * If you use the Gutenberg module versions 8.x-2.x, upgrade to Gutenberg 8.x-2.15 [4] Reported By: * Tommaso Gregori (p1s1o) [5] * Drew Webber (mcdruid) [6] of the Drupal Security Team Fixed By: * Stephan Zeidler (szeidler) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/gutenberg [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gutenberg/releases/3.0.7 [4] https://www.drupal.org/project/gutenberg/releases/8.x-2.15 [5] https://www.drupal.org/u/p1s1o [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/szeidler [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....