View online: https://www.drupal.org/sa-contrib-2026-280 Project: Bulk Update User Roles [1] Project machine name: bulk_update_user_roles Date: 2026-October-28 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Incorrect authorization Affected versions: <1.0.5 CVE IDs: CVE-2026-118567 Description: This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update form does not prevent access to users who do not have permission to assign roles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users". Solution: Install the latest version: * If you use the Bulk Update User Roles module for Drupal 11, upgrade to Bulk Update User Roles 1.0.5 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Marcus Johansson (marcus_johansson) [5] * Zeeshaan khann (zeeshan_khan) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/bulk_update_user_roles [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/bulk_update_user_roles/releases/1.0.5 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/zeeshan_khan [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mrbaileys [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....