View online: https://www.drupal.org/sa-contrib-2026-059 Project: WissKI [1] Date: 2026-June-24 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <4.2.0 CVE IDs: CVE-2026-13239 Description: The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer. It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass. This vulnerability is mitigated by the fact that it is specific to the wisski_mirador submodule. Solution: Install the latest version: * If you use the WissKI module version 8.x-4.1, upgrade to WissKI 8.x-4.2 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * knurg [5] Coordinated By: * cilefen (cilefen) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185226-wisski-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/wisski [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/wisski/releases/8.x-4.2 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/knurg [6] https://www.drupal.org/u/cilefen [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185226-wisski-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....