View online: https://www.drupal.org/sa-contrib-2026-074 Project: ECA: Event - Condition - Action [1] Date: 2026-July-08 Security risk: *Less critical* 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.1.20 || >=3.0.0 <3.0.12 || >=3.1.0 <3.1.4 CVE IDs: CVE-2026-15083 Description:  The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is mitigated by the fact that a site must be running an ECA model that uses the "Render: Twig" action on a data flow. Solution:  Install the latest version: * If you use the ECA 3.1 for Drupal 10.x or 11.x, upgrade to ECA 3.1.4 [3] * If you use the ECA 3.0 for Drupal 10.x or 11.x, upgrade to ECA 3.0.12 [4] * If you use the ECA 1.2 for Drupal 10.x or 11.x, upgrade to ECA 2.1.20 [5] Reported By:  * Changhai Qi (qichanghai) [6] Fixed By:  * Jürgen Haas (jurgenhaas) [7] Coordinated By:  * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/eca [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3609312 [4] https://www.drupal.org/node/3609311 [5] https://www.drupal.org/node/3609310 [6] https://www.drupal.org/u/qichanghai [7] https://www.drupal.org/u/jurgenhaas [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/longwave [11] https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....