View online: https://www.drupal.org/sa-contrib-2026-198 Project: Actstream [1] Project machine name: actstream Date: 2026-October-07 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.1 || >=2.1.0 <2.1.1 CVE IDs: CVE-2026-107257 Description: Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities. The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass vulnerability. Solution: Install the latest version: * If you use Actstream 2.1.x, upgrade to Actstream 2.1.1 [3]. * If you use Actstream 2.0.x, upgrade to Actstream 2.0.1 [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Reva Gomes (revagomes) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/actstream [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/actstream/releases/2.1.1 [4] https://www.drupal.org/project/actstream/releases/2.0.1 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/revagomes [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....