View online: https://www.drupal.org/sa-contrib-2026-107 Project: Content Moderation Notifications [1] Date: 2026-August-26 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.9.0 CVE IDs: CVE-2026-81161 Description: The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted. A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators. Solution: Install the latest version: * If you use Content Moderation Notifications, upgrade to version 8.x-3.9 [3]. * Review roles to ensure only trusted roles have access to the "administer content moderation notifications" permission. changed. Reported By: * Lee Rowlands (larowlan) [4] of the Drupal Security Team * Luke Leber (luke.leber) [5] Fixed By: * Brian Osborne (bkosborne) [6] * Jonathan Hedstrom (jhedstrom) [7] * Luke Leber (luke.leber) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Lee Rowlands (larowlan) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/content_moderation_notifications [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/content_moderation_notifications/releases/8.x... [4] https://www.drupal.org/u/larowlan [5] https://www.drupal.org/u/lukeleber [6] https://www.drupal.org/u/bkosborne [7] https://www.drupal.org/u/jhedstrom [8] https://www.drupal.org/u/lukeleber [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/larowlan [12] https://www.drupal.org/u/poker10 [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....