View online: https://www.drupal.org/sa-contrib-2026-238 Project: Domain [1] Project machine name: domain Date: 2026-October-21 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <3.0.2 Description: This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled. This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assigned domains" together with a per-content-type permission such as "Article: Edit any content on assigned domains", and must be assigned to at least one domain. Solution: Install the latest version: * If you use the Domain 3.0.x, upgrade to Domain 3.0.2 [3] The 2.0.x branch of the module is not affected by this vulnerability. Reported By: * Frank Mably (mably) [4] Fixed By: * Frank Mably (mably) [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [7] [1] https://www.drupal.org/project/domain [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/domain/releases/3.0.2 [4] https://www.drupal.org/u/mably [5] https://www.drupal.org/u/mably [6] https://www.drupal.org/u/poker10 [7] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....