View online: https://www.drupal.org/sa-contrib-2026-052 Project: Advanced Content Feedback (aka admin_feedback) [1] Date: 2026-June-24 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass / Insecure Direct Object Reference (IDOR) Affected versions: <2.8.0 CVE IDs: CVE-2026-13232 Description:  This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote. The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "give feedback". Note: "give feedback" is granted to anonymous and authenticated by default on install. Solution:  Install the latest release: * If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8 [3] The comment endpoint now requires an HMAC-signed token bound to the specific feedback row (issued only to the visitor who cast that vote), and a comment may be written only once, preventing both forgery of arbitrary ids and replay. Reported By:  * Bill Seremetis (bserem) [4] Fixed By:  * Bill Seremetis (bserem) [5] Coordinated By:  * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_items/… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/admin_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_feedback/releases/8.x-2.8 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_it... [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....