View online: https://www.drupal.org/sa-contrib-2026-243 Project: Media Bulk Upload [1] Project machine name: media_bulk_upload Date: 2026-October-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <3.0.6 CVE IDs: CVE-2026-114544 Description: This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "bulk upload form". Solution: Install the latest version: * If you use Media Bulk Upload module, upgrade to Media Bulk Upload 3.0.6 [3] Reported By: * Stuart Rowlands (stooit) [4] Fixed By: * Jen M (jannakha) [5] * Sjoerd Wenker (sjerdo) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/media_bulk_upload [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/media_bulk_upload/releases/3.0.6 [4] https://www.drupal.org/u/stooit [5] https://www.drupal.org/u/jannakha [6] https://www.drupal.org/u/sjerdo [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....