View online: https://www.drupal.org/sa-contrib-2026-205 Project: Views Share [1] Project machine name: views_share Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.1 CVE IDs: CVE-2026-107266 Description: This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability is mitigated by the fact that an attacker must know the view and display IDs. Solution: Install the latest version: * If you use the Views Share module, upgrade to Views Share 2.0.1 [3] Reported By: * Hemant Gupta (guptahemant) [4] Fixed By: * Daniel Cothran (andileco) [5] * Hemant Gupta (guptahemant) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/views_share [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views_share/releases/2.0.1 [4] https://www.drupal.org/u/guptahemant [5] https://www.drupal.org/u/andileco [6] https://www.drupal.org/u/guptahemant [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....